From 815d42d21175fff1eb593c355024fbc19ba83ea4 Mon Sep 17 00:00:00 2001
From: cruizba <carlos.ruizbal@gmail.com>
Date: Mon, 28 Sep 2026 20:24:55 +0200
Subject: [PATCH] openvidu-deployment: HA AWS - run the Docker Hub cache of the
 Master Nodes unprivileged

- The pull-through cache for private Media Nodes ran as root with no sandboxing. It now
  runs as a transient systemd user (DynamicUser) with no capabilities: it can only write
  its own cache (StateDirectory, /var/lib/registry-mirror), and systemd restricts its
  kernel, device, namespace, address family and syscall access. TCP 5555 needs no
  privileges.
- registry_mirror.sh no longer creates the cache directory: systemd creates it with the
  right owner.


Assisted-by: claude-code - Anthropic - Claude Opus 5.5
---
 .../pro/ha/aws/cf-openvidu-ha.yaml               | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml b/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml
index d056e31c9..62ac55d58 100644
--- a/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml
+++ b/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml
@@ -1880,7 +1880,7 @@ Resources:
                   "https://github.com/distribution/distribution/releases/download/${!REGISTRY_VERSION}/registry_${!REGISTRY_VERSION#v}_linux_${!ARCH}.tar.gz"
                 tar xzf /tmp/registry.tar.gz -C /usr/local/bin registry
                 rm -f /tmp/registry.tar.gz
-                mkdir -p /etc/registry-mirror /var/lib/registry-mirror
+                mkdir -p /etc/registry-mirror
                 cat > /etc/registry-mirror/config.yml <<'EOF'
                 version: 0.1
                 log:
@@ -1906,6 +1906,20 @@ Resources:
                 # No OpenTelemetry collector: do not export traces
                 Environment=OTEL_TRACES_EXPORTER=none
                 ExecStart=/usr/local/bin/registry serve /etc/registry-mirror/config.yml
+                # Unprivileged: a transient user that can only write its own cache
+                # (/var/lib/registry-mirror); 5555 needs no capabilities
+                DynamicUser=yes
+                StateDirectory=registry-mirror
+                CapabilityBoundingSet=
+                PrivateDevices=yes
+                ProtectKernelTunables=yes
+                ProtectKernelModules=yes
+                ProtectControlGroups=yes
+                RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+                RestrictNamespaces=yes
+                LockPersonality=yes
+                SystemCallArchitectures=native
+                SystemCallFilter=@system-service
                 Restart=always
                 RestartSec=5