[oleksandr-nc]

COPY --chmod=664 spoe-agent.conf /etc/haproxy/spoe-agent.conf also creates the /etc/haproxy directory with mode 664, without the execute bit. A process that cannot bypass file permissions then cannot open spoe-agent.conf, and HaRP exits at startup with stat() failed for configuration file /etc/haproxy/spoe-agent.conf : Permission denied. This happens when the container runs as a non-root user, and also as root with all capabilities dropped (--cap-drop ALL, or capabilities: drop: [ALL] in a Kubernetes pod).

Changes

• The Dockerfile creates /etc/haproxy with mode 755 before it copies spoe-agent.conf into it.

Containers that run as root with the default capabilities are unaffected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f17fbf83-1678-4ca6-9676-bd1086a20d9c

📥 Commits

Reviewing files that changed from the base of the PR and between d423e79 and 72a09d4.

📒 Files selected for processing: 1

• Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The Dockerfile now creates /etc/haproxy with mode 755 before copying the SPOE configuration.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 72a09

No actionable merge-blocking risk remains for this focused Dockerfile change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main Dockerfile change: creating /etc/haproxy with mode 755.
Description check		The description directly explains the permission issue, affected runtime conditions, error message, and implemented Dockerfile fix.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}