Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add an option to add and drop capabilities in the Docker driver #3754

Merged
merged 7 commits into from
Jan 23, 2018
Merged

Add an option to add and drop capabilities in the Docker driver #3754

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7f072ab
Add an option to add and drop capabilities in the Docker driver
filipochnik Jan 14, 2018
8f23c95
Add a sketch of capabilities whitelist logic for the Docker driver
filipochnik Jan 14, 2018
4080aac
Finish implementation of the capabilities whitelist
filipochnik Jan 21, 2018
b509b0a
Merge branch 'master' into docker-caps
filipochnik Jan 21, 2018
45d53ca
Merge branch 'master' into docker-caps
filipochnik Jan 21, 2018
0ec61a8
Fix moby package location
filipochnik Jan 21, 2018
35d9331
Document the ALL value for docker.caps.whitelist
filipochnik Jan 23, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion website/source/docs/drivers/docker.html.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -625,7 +625,8 @@ options](/docs/agent/configuration/client.html#options):
which is the list of capabilities allowed by docker by default, as
[defined here](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities).
Allows the operator to control which capabilities can be obtained by
tasks using `cap_add` and `cap_drop` options.
tasks using `cap_add` and `cap_drop` options. Supports the value `"ALL"` as a
Copy link

@adebnath-rb adebnath-rb Feb 24, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How can I set the "cap_add" & "cap_drop" in the .nomad file?
I am using nomad v0.6.2 and if I add "cap_add" : ["NET_ADMIN"]" in Tasks, I get the error "Cap_add is an invalid field" in nomad.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which version of Nomad are you using? This will be available in 0.8.0, which hasn't been released yet.
If you are using your own development build of 0.8.0 and you find the docs unclear I suggest you write to Nomad mailing list or if you suspect a bug, submit a new issue. There's a much higher chance of getting a response that way :)

shortcut for whitelisting all capabilities.

Note: When testing or using the `-dev` flag you can use `DOCKER_HOST`,
`DOCKER_TLS_VERIFY`, and `DOCKER_CERT_PATH` to customize Nomad's behavior. If
Expand Down