From 792bfa7a8ae478ad9d053be10768f72275c76a5c Mon Sep 17 00:00:00 2001
From: bulbashenko <admin@bulbashenko.com>
Date: Mon, 12 Oct 2026 02:35:19 +0200
Subject: [PATCH] Let the Stalwart binary keep its file capability

The image sets cap_net_bind_service on /usr/local/bin/stalwart; with every
capability dropped and no privilege escalation the kernel refuses to exec
it (operation not permitted). Allow just NET_BIND_SERVICE.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 deploy/k8s/stalwart.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/deploy/k8s/stalwart.yaml b/deploy/k8s/stalwart.yaml
index ffce525..f0da34a 100644
--- a/deploy/k8s/stalwart.yaml
+++ b/deploy/k8s/stalwart.yaml
@@ -51,8 +51,10 @@ spec:
             requests: { cpu: 50m, memory: 192Mi }
             limits: { memory: 1Gi }
           securityContext:
-            allowPrivilegeEscalation: false
-            capabilities: { drop: [ALL] }
+            # The binary carries the file capability cap_net_bind_service; exec fails (EPERM) unless it
+            # can be granted. Everything else stays dropped.
+            allowPrivilegeEscalation: true
+            capabilities: { drop: [ALL], add: [NET_BIND_SERVICE] }
           volumeMounts:
             - { name: config, mountPath: /etc/stalwart }
             # Scratch space and the file tracer (/var/lib/stalwart/logs); nothing durable lives here.