When embedding containers with MicroShift to run it using bootc we encountered an issue with the capabilities in the haproxy binary.
According to https://github.com/openshift/router/blob/master/images/router/haproxy/Dockerfile#L9C1-L10C1 the cap_net_bind_service is added so that it can use ports below 1024.
When embedding this container in bootc the capabilities are lost (See https://github.com/ostreedev/ostree-rs-ext/issues/654 and https://github.com/ostreedev/ostree-rs-ext/issues/655).
While this is a bug in ostree, does haproxy need to be able to bind to privileged ports?
    

4.18
    

    1.
    2.
    3.