Running hardend container (cap_drop: ALL, i.e. without CAP_DAC_OVERRIDE) results in raw directory listing at /web/

[schainks]

Issue Description

AI disclosure: diagnosis, reproduction, and this write-up were AI-assisted (Claude Code). I reviewed and edited it, and verified the root cause, the regression source, and the workaround on my own hardware.

When running a hardend container (cap_drop: ALL, i.e. without CAP_DAC_OVERRIDE), the omnibus web UI serves a raw directory listing at /web/ instead of the app, and static routes will 403.

Root cause: /opt/scrutiny/web ships mode 644 — a directory with no execute/search bit — so every file under it is unreadable (EACCES) once DAC_OVERRIDE is dropped. Running as default root masks it.

This is a regression of #502, which was fixed by #520. #520 added chmod -R a+rX /opt/scrutiny to the old docker/Dockerfile.web. When that was consolidated into the omnibus docker/Dockerfile, the fix was replaced with COPY --chmod=644 … /opt/scrutiny/web, and 644 on a directory strips the search bit a+rX had restored.

Expected Behavior

/web/ serves the Scrutiny dashboard regardless of Linux capabilities, as it did before the omnibus Dockerfile consolidation.

Actual Behavior

Under cap_drop: ALL, /web/ returns a directory listing (Go's FileServer can't open index.html), /web/dashboard and other routes 403, and HEAD /api/health 403s — which also hangs the omnibus collector-once boot script (its curl --head --fail wait loop never exits, logging "scrutiny api not ready" forever).

Reproduction Steps

1. Run ghcr.io/analogj/scrutiny:v0.9.2-omnibus with cap_drop: ALL and only cap_add: [SYS_RAWIO].
2. Open /web/ → directory listing instead of the dashboard.
3. Or, without any setup: docker run --rm --entrypoint sh ghcr.io/analogj/scrutiny:v0.9.2-omnibus -c 'ls -lan /opt/scrutiny/web' shows the dir is mode 644.

scrutiny debug logs

waiting for scrutiny service to start
scrutiny api not ready         (repeats — HEAD /api/health returns 403)
GET /web/ 200                    (serves directory listing, not index.html)

### Scrutiny Version

v0.9.2

### Smartmontools Version

docker

### OS Version Information

Ubuntu 24.04.2 (Noble Numbat)

### Component

omnibus (docker only)

### Deployment Method

- [X] docker
- [ ] binaries
- [ ] systemd

### Hard Drive Information

_No response_

### smartctl output

_No response_

### docker-compose.yml

```yaml
scrutiny:
  image: ghcr.io/analogj/scrutiny:v0.9.2-omnibus
  cap_drop: [ALL]
  cap_add: [SYS_RAWIO]        # add DAC_READ_SEARCH to work around this bug
  devices: ["/dev/sda:/dev/sda"]
  volumes: ["/run/udev:/run/udev:ro"]

### scrutiny.yaml

_No response_

### collector.yaml

_No response_

### Additional relevant configuration

_No response_

### I acknowledge that:

- [X] I have reviewed the FAQ and confirm that my issue is NOT among them.
- [X] I have searched the scrutiny repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
- [X] I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (` ``` `) on separate lines.