25072914818
84%
master: 93%

Ran 28 Apr 2026 07:22PM UTC

Jobs 1

Files 23

Run time 1min

Badge

Embed ▾

Committed 28 Apr 2026 07:20PM UTC coverage: 83.829%. Remained the same

Build # 25072914818

Build Type

push

github

Committed by

dunglas

Commit Message

docs(chart): drop NET_BIND_SERVICE from the rootless example, target an unprivileged port

Binding 80/443 from a securityContext with `allowPrivilegeEscalation: false`
fails regardless of `capabilities.add: [NET_BIND_SERVICE]`: K8s puts the cap
in Permitted and Bounding only, no_new_privs makes the binary's file
capability moot on exec, and there is no field to grant Ambient. The new
effective set after runc execs into caddy is empty, so `bind(:80)` returns
EACCES.

Recommend `service.targetPort: 8080` instead so caddy listens on an
unprivileged port; the Service still exposes :80 to the cluster. Drop
`add: [NET_BIND_SERVICE]` from both the values.yaml example and the
install.md snippet, and rewrite the comments to describe what actually
happens. Regenerate the chart README via helm-docs.

Coverage Stats

1747 of 2084 relevant lines covered (83.83%)

50.36 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	0 - 25072914818.1	28 Apr 2026 07:22PM UTC	23	83.83	GitHub Action Run

dunglas / mercure / 25072914818
84%
master: 93%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 25072914818

dunglas / mercure / 25072914818 84% master: 93%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 25072914818

dunglas / mercure / 25072914818
84%
master: 93%

README BADGES
x