From 795d3844dc9f9afe5f634f0d47a68cf2e450be85 Mon Sep 17 00:00:00 2001
From: Michael Trip <michael@alcatrash.org>
Date: Tue, 23 Jun 2026 16:00:46 +0200
Subject: [PATCH] Add SYS_CHROOT capability to container security context

---
 k8s/deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 9bc3445..9881843 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -85,7 +85,7 @@ spec:
             readOnlyRootFilesystem: false
             capabilities:
               drop: ["ALL"]
-              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
+              add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID", "SYS_CHROOT"]
       volumes:
         - name: state
           emptyDir: {}