From e138c45d5190e614567fdd5e14fa6bbcdacf34a0 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sun, 26 Apr 2026 01:17:41 -0500 Subject: [PATCH] Fix BuildKit rootless: allow privilege escalation for newuidmap/newgidmap --- servers/legion/k8s/gitea-runner/buildkitd.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/servers/legion/k8s/gitea-runner/buildkitd.yaml b/servers/legion/k8s/gitea-runner/buildkitd.yaml index 7abb889..4e18a65 100644 --- a/servers/legion/k8s/gitea-runner/buildkitd.yaml +++ b/servers/legion/k8s/gitea-runner/buildkitd.yaml @@ -35,9 +35,10 @@ spec: containerPort: 1234 securityContext: seccompProfile: - type: Unconfined # BuildKit rootless requires this + type: Unconfined # BuildKit rootless requires this runAsUser: 1000 runAsGroup: 1000 + allowPrivilegeEscalation: true # required for newuidmap/newgidmap setuid binaries readinessProbe: exec: command: ["buildctl", "debug", "workers"]