From 39641b73d496cef9ed3a564aa8d97566c1fdad56 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 11 Feb 2026 10:58:30 -0600
Subject: [PATCH] enable ping in docker container for non-root user

add libcap and setcap cap_net_raw+p on /bin/ping so ICMP works
without container-level capabilities. add NET_RAW cap_add to
docker-compose.example.yml as fallback.
---
 Dockerfile                 | 3 ++-
 docker-compose.example.yml | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 080341e..d426976 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,8 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION}" -o towerops-agent .
 
 FROM alpine:3.23
-RUN apk add --no-cache ca-certificates iputils
+RUN apk add --no-cache ca-certificates iputils libcap && \
+    setcap cap_net_raw+p /bin/ping
 COPY --from=builder /app/towerops-agent /usr/local/bin/towerops-agent
 RUN adduser -D -u 1000 towerops && chown towerops /usr/local/bin/towerops-agent
 USER towerops
diff --git a/docker-compose.example.yml b/docker-compose.example.yml
index 689d630..f649d24 100644
--- a/docker-compose.example.yml
+++ b/docker-compose.example.yml
@@ -3,6 +3,8 @@ services:
     image: ghcr.io/towerops-app/towerops-agent:latest
     container_name: towerops-agent
     restart: unless-stopped
+    cap_add:
+      - NET_RAW
 
     environment:
       # Required: Agent authentication token (from Towerops web UI)