From 3741ecda0b5ba1ab3a5b9916900e47e6ece92084 Mon Sep 17 00:00:00 2001
From: yu-xin-c <2182712990@qq.com>
Date: Mon, 10 Aug 2026 16:36:22 +0800
Subject: [PATCH] fix(docker): restore capabilities for privilege drop

---
 .github/workflows/ci.yml | 5 +++++
 docker-compose.yml       | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1df3e92a..28cf3ccfc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -189,6 +189,11 @@ jobs:
       - name: Build image with default channel dependencies
         run: docker build -t nanobot:test .
 
+      - name: Verify Docker Compose startup
+        env:
+          HOME: ${{ runner.temp }}
+        run: docker compose run --rm --no-deps --build -T nanobot-cli status
+
       - name: Verify default WhatsApp dependencies
         run: docker run --rm --entrypoint python nanobot:test -c "import neonize, segno"
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 96d138e24..86706a8e0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,11 @@ x-common-config: &common-config
     - ~/.nanobot:/home/nanobot/.nanobot
   cap_drop:
     - ALL
+  # Entrypoint uses these to fix bind-mount ownership and drop to the nanobot user.
+  cap_add:
+    - CHOWN
+    - SETGID
+    - SETUID
 
 services:
   nanobot-gateway: