Support CapAdd And CapDrop in Docker driver

[samart]

In order to run docker containers more securely, i would like to drop container privileges - and hence pass some extra args for the nomad - docker engine api container create call.

"CapAdd": [
".."
],
"CapDrop": [
"..."
],

http://www.projectatomic.io/blog/2016/01/how-to-run-a-more-secure-non-root-user-container/
https://opensource.com/business/15/3/docker-security-tuning

[schmichael]

References for implementers:

• Docker docs: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
• Docker client lib config: https://godoc.org/github.com/fsouza/go-dockerclient#HostConfig
• Probably implemented similar to this field:

  nomad/client/driver/docker.go

  Line 203 in 12ce2c9

  SecurityOpt []string `mapstructure:"security_opt"` // Flags to pass directly to security-opt

• Document here: https://github.com/hashicorp/nomad/blob/12ce2c93e6053323d3c76777141bd74b2e1a3055/website/source/docs/drivers/docker.html.md

[filipochnik]

I can try implementing this if no one is working on it yet.

[schmichael]

@filipochnik No one on the HashiCorp team has gotten around to it yet, so please do!

[filipochnik]

@schmichael I think I have it working. One thing that came to my mind in the process is that it might be useful to have an option to specify whitelist and blacklist for capabilities in the client config (probably here https://www.nomadproject.io/docs/drivers/docker.html#client-configuration). What do you think? It looks a bit tricky to implement given the special semantics of the ALL capability.

[alxark]

@filipochnik could you please check for tmpfs and readonlyrootfs options for docker driver? I think you can implement them really fast after digging to nomad docker driver.

[filipochnik]

@alxark I'll try to, once I'm done with this :)

[alxark]

@filipochnik will be just great =)

[dadgar]

Closed by #3754

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.