Adding Capability and Security options to kolla-docker

[Serguei Bezverkhi]

In some situation container needs to have additional capabilities and security options added. Example: Capability - cap_net_bind_service or SecurityOpt - seccomp=unconfined. The fix for this bug will add ability to specify this capabilities and security.

[Hui Kang (huikang27)]

Hi, Serguer, could you explain in what situation these capabilities are needed? Thanks. - Hui

[Serguei Bezverkhi (sbezverk)]

Recently we needed to allow a process to bind to a socket in the privilege rage 1-1024, it either requires root priv for this process or you can add capability net_bind_service to the container where this process runs. With Docker version 1.10 and higher, adding capabilities gets blocked by default to actually enable it you need to change default security profile. This is done by using security option for docker container. Please let me know if you have more questions.
Serguei

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/308447
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=a08a762f30e40dcfd436d76c58e9ce1d989a4a69
Submitter: Jenkins
Branch: master

commit a08a762f30e40dcfd436d76c58e9ce1d989a4a69
Author: Serguei Bezverkhi <email address hidden>
Date: Wed Apr 20 12:13:36 2016 -0400

    Adding ability to specify capabilities and security

    This patch adds ability to specify required capabilities and security
    mode for a specific docker container.

    Change-Id: Ib8c15a8e354178bedd31ebb31a64618431f0e135
    Closes-Bug: #1572648

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/kolla 3.0.0.0b1 development milestone.