Merge branch 'main' into improved-proxy-support

Author: poupas

compose/docker-compose.yml

@@ -15,7 +15,7 @@ services:
     #   Probely's API URL. If not set, the Agent will use the API URLs for all regions.
     #
     #   FARCASTER_FORCE_TCP
-    #   If set to true, the Agent will use TCP to connect to Snyk.
+    #   If set to true, the Agent will use TCP to connect to Probely/Snyk.
     #
     #   FARCASTER_PROXY_NAMES
     #   If set to true, the Agent will use hostnames in proxy requests when available.
@@ -32,7 +32,7 @@ services:
     tmpfs:
     - /run
     cap_add:
-      # Required for WireGuard kernel support. If you remove this, the Agent will fall back to a userspace TCP/IP stack.
+      # Required to use the kernel WireGuard implementation. If you remove this, the Agent will fall back to a userspace implementation.
       - NET_ADMIN
     restart: unless-stopped
 

contrib/kubernetes/agent-depl.yml

@@ -13,18 +13,6 @@ spec:
       labels:
         app: farcaster-agent
     spec:
-      initContainers:
-      - name: init
-        image: busybox:stable
-        command:
-        - sh
-        - -c
-        - sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1
-        securityContext:
-          privileged: true
-          capabilities:
-            add:
-            - NET_ADMIN
       containers:
       - name: agent
         image: probely/farcaster-onprem-agent:v3
@@ -35,16 +23,12 @@ spec:
             secretKeyRef:
               name: farcaster-secrets
               key: token
-        - name: DISABLE_FIREWALL
-          value: "0"
         resources:
           requests:
             cpu: "1"
             memory: "128Mi"
         securityContext:
-          capabilities:
-            add:
-            - SETUID
+            allowPrivilegeEscalation: false
         volumeMounts:
         - name: run-tmpfs
           mountPath: /run