From fcf2e9a9107c6c9aebaf63ce044f636333e7eed8 Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Tue, 20 May 2014 09:58:30 +0200 Subject: [PATCH] native driver: Add required capabilities We need SETFCAP to be able to mark files as having caps, which is heavily used by fedora. See https://github.com/dotcloud/docker/issues/5928 We also need SETPCAP, for instance systemd needs this to set caps on its childen. Both of these are safe in the sense that they can never ever result in a process with a capability not in the bounding set of the container. We also add NET_BIND_SERVICE caps, to be able to bind to ports lower than 1024. Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: alexlarsson) --- daemon/execdriver/native/template/default_template.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/daemon/execdriver/native/template/default_template.go b/daemon/execdriver/native/template/default_template.go index 5c41603428..ba52499c24 100644 --- a/daemon/execdriver/native/template/default_template.go +++ b/daemon/execdriver/native/template/default_template.go @@ -17,6 +17,9 @@ func New() *libcontainer.Container { "NET_RAW", "SETGID", "SETUID", + "SETFCAP", + "SETPCAP", + "NET_BIND_SERVICE", }, Namespaces: map[string]bool{ "NEWNS": true,