HAProxy as root

Requests
1

Hi,

regarding haproxy.cfg, the global section contains:

global
        maxconn 64
        chroot /var/lib/haproxy
        stats socket /run/haproxy.sock mode 660 level admin
        stats timeout 30s
        user root
        group root

I wanted to flag this because running the HAProxy worker process as user root and group root seems to present a few security issues:

  1. Defeating the chroot jail: The config sets chroot /var/lib/haproxy, but a root user can break out of a chroot jail if remote code execution occurs.

  2. Principle of Least Privilege: HAProxy only needs root permissions at startup to bind to privileged ports (80/443). After binding, best practice is to drop privileges to a non-root system account (e.g., haproxy:haproxy).

Is there a specific DietPi architectural reason why user root and group root are set in the default configuration?

If not, would it be better to change this default to user haproxy / group haproxy (and ensure /var/lib/haproxy ownership is updated accordingly) in future image builds or software installations?

thanks

2

something we would need to have a look into