From 52ded39b1975e2f3a4f0d5f0c1421a7dba2cf4e8 Mon Sep 17 00:00:00 2001
From: Dmitry Gammel <cactozzz93@gmail.com>
Date: Tue, 10 Nov 2026 01:47:52 +0500
Subject: [PATCH] =?UTF-8?q?nginx:=20=D0=B2=D0=B5=D1=80=D0=BD=D1=83=D1=82?=
 =?UTF-8?q?=D1=8C=20CHOWN/SETUID/SETGID=20=E2=80=94=20=D0=BC=D0=B0=D1=81?=
 =?UTF-8?q?=D1=82=D0=B5=D1=80=20chown'=D0=B8=D1=82=20=D0=BA=D1=8D=D1=88=20?=
 =?UTF-8?q?=D0=B2=D0=BE=D1=80=D0=BA=D0=B5=D1=80=D1=83=20=D0=BF=D1=80=D0=B8?=
 =?UTF-8?q?=20=D1=81=D1=82=D0=B0=D1=80=D1=82=D0=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docker-compose.prod.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 78739fe..a4634d4 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -15,7 +15,13 @@ services:
     cap_drop:
       - ALL
     cap_add:
+      # NET_BIND_SERVICE — слушать :80; CHOWN/SETUID/SETGID — nginx при старте
+      # отдаёт кэш-директории воркеру (chown client_temp ...) и сбрасывает
+      # права мастера на пользователя nginx
       - NET_BIND_SERVICE
+      - CHOWN
+      - SETUID
+      - SETGID
     healthcheck:
       test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1/ || exit 1"]
       interval: 30s