From 9c20faf8de608eb87d3eb7741d1f696c86abdffb Mon Sep 17 00:00:00 2001
From: Julian Cuni <julian.cuni@microservices.al>
Date: Sat, 27 Jun 2026 12:59:10 +0200
Subject: [PATCH] fix(deploy): drop server sysctls under host net (runc rejects
 per-netns sysctl)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

network_mode: host + sysctls: net.ipv4.ping_group_range fails at container create:
"sysctl not allowed in host network namespace" — runc refuses a per-netns sysctl
when there's no separate netns. Remove it; under host net the server uses the HOST's
ping_group_range (set on the booth via /etc/sysctl.d). Fixes the park-buzi-server-1
start failure introduced by c87dcb2.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
---
 docker-compose.prod.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 79316e2..bb098be 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -47,11 +47,10 @@ services:
     # Listens on :3000 directly on the host (Caddy proxies it). Loopback to vision:
     environment:
       VISION_URL: http://127.0.0.1:8089
-    # Reader liveness ping (Dingtian/GEE QR push-only readers): on host net the server uses the
-    # HOST's net.ipv4.ping_group_range — ensure the host sets it (see appliance-provisioning).
-    # The container-level sysctl below is a no-op under host net but kept as documentation.
-    sysctls:
-      - net.ipv4.ping_group_range=0 2147483647
+    # NB: NO `sysctls:` here. net.ipv4.ping_group_range is a per-netns sysctl; under host net
+    # there is no separate namespace, and runc REFUSES it ("not allowed in host network
+    # namespace"). Reader liveness ping uses the HOST's setting instead — the booth host must
+    # set net.ipv4.ping_group_range (see appliance-provisioning §7 / disk-os-hardening).
     logging:
       driver: json-file
       options: