Add TODO.md and document ping fix for unprivileged containers

- Created TODO.md with pending task to fix ping on all containers
- Added setcap command to standard container setup in documentation
- Added detailed explanation in CLAUDE.md for future reference
- Unprivileged containers need cap_net_raw on /bin/ping

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CLAUDE.md

@@ -112,6 +112,20 @@ ssh mikkel@10.5.0.111  # dev container
 ssh root@10.5.0.1 'cd /opt/npm && docker compose pull && docker compose up -d'
 ```
 
+**Enable ping in unprivileged containers:**
+
+Unprivileged LXC containers drop `cap_net_raw` capability, causing ping to fail with "Operation not permitted". Fix by granting the capability to the ping binary:
+
+```bash
+# Run inside the container as root
+setcap cap_net_raw+ep /bin/ping
+
+# Or from PVE host
+ssh root@10.5.0.254 'pct exec <vmid> -- setcap cap_net_raw+ep /bin/ping'
+```
+
+Note: Must be re-applied after `iputils-ping` package upgrades.
+
 ## User Preferences
 
 - Python and Batch for scripting

README.md

@@ -6,6 +6,7 @@ Infrastructure documentation and management for Mikkel's homelab.
 
 - **homelab-documentation.md** - Complete infrastructure documentation
 - **CLAUDE.md** - Claude Code guidance and quick reference
+- **TODO.md** - Pending maintenance tasks
 
 ## Management Container
 

TODO.md

@@ -0,0 +1,11 @@
+# Homelab TODO
+
+## Pending Tasks
+
+- [ ] **Fix ping on all unprivileged containers** - Run `setcap cap_net_raw+ep /bin/ping` on each container (requires restart or at least root access inside container)
+  - Containers to fix: 100 (npm), 101 (dockge), 102 (mgmt), 103 (postgresql01), 104 (redis01), 105 (sentry), 107 (pve-scripts-local), 108 (jukebox), 110 (sense), 111 (dev), 112 (dataloes), 114 (forgejo), 115 (dns), 1000 (tailscale)
+  - Skip: 106 (pbs) - privileged container, 113 (general) - already done
+
+## Completed
+
+- [x] Fix ping on container 113 (general) - 2025-01-14

homelab-documentation.md

@@ -469,6 +469,11 @@ echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIOQrK06zVkfY6C1ec69kEZYjf8tC98icCcBju
 chmod 700 /root/.ssh /home/mikkel/.ssh
 chmod 600 /root/.ssh/authorized_keys /home/mikkel/.ssh/authorized_keys
 chown -R mikkel:georgsen /home/mikkel/.ssh
+
+# Enable ping in unprivileged containers (required because cap_net_raw is dropped)
+# Without this, ping fails with "Operation not permitted"
+# Must be re-applied if iputils-ping package is upgraded
+setcap cap_net_raw+ep /bin/ping
 ```
 
 ---