From 3a3f318779eb801d9d905c320934b84fab5c5313 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?m=C3=BCde?= Date: Mon, 13 Jul 2026 13:57:37 +0200 Subject: [PATCH] =?UTF-8?q?fix(#2363):=20grant=20hive-gateway=20CAP=5FNET?= =?UTF-8?q?=5FADMIN=20=E2=80=94=20dnsmasq=20DHCP=20mode=20requires=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- nix/modules/hive-gateway.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index b3f13f13..71dcb87b 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -481,6 +481,14 @@ in # port-forward dance, and the firewall config below is the only # layer that matters. privateNetwork = false; + # dnsmasq refuses to start once a dhcp-range is configured unless it + # holds CAP_NET_ADMIN (DNS-only mode doesn't need it). Private-network + # containers retain NET_ADMIN implicitly, but this container shares the + # host netns (above), so nspawn's default bounding set drops it — grant + # it explicitly. Note this is NET_ADMIN over the *host* netns; the + # gateway container is trusted infra (it already terminates TLS and + # fronts every vhost), so no new trust boundary is crossed. + additionalCapabilities = [ "CAP_NET_ADMIN" ]; # Bind-mount the per-agent socket dir so nginx inside the gateway # container can `connect(2)` to the UDS upstreams. # Read-only (we just connect; harness writes the socket inside