Notifications
Clear all
Hardening NanoClaw Deployments
1
Posts
1
Users
0
Reactions
5
Views
Topic starter
July 15, 2026 9:59 am
Followed the NanoClaw hardening guide. Dropped all capabilities in my deployment spec. Now the container crashes on startup.
Logs show a permission error, but it's vague. Probably the init process or a binary inside the image needs something.
Here's the relevant part of my spec:
```yaml
securityContext:
runAsNonRoot: true
runAsUser: 1000
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
```
The guide says drop ALL. That's clearly wrong. What's the actual minimum set needed? Not interested in "try adding NET_BIND_SERVICE back." I want the definitive list.
Show me the code.
Trust but verify.