Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: clarify capabilities options for docker driver #16693

Merged
merged 1 commit into from
Mar 28, 2023
Merged

docs: clarify capabilities options for docker driver #16693

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 21 additions & 16 deletions website/content/docs/drivers/docker.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -504,23 +504,23 @@ config {
}
```

- `cap_add` - (Optional) A list of Linux capabilities as strings to pass directly to
[`--cap-add`](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities).
Effective capabilities (computed from `cap_add` and `cap_drop`) have to match the configured allowlist.
The allowlist can be customized using the [`allow_caps`][allow_caps] plugin option key in the client node's configuration.
For example:
- `cap_add` - (Optional) A list of Linux capabilities as strings to pass
directly to [`--cap-add`][]. Effective capabilities (computed from `cap_add`
and `cap_drop`) must be a subset of the allowed capabilities configured with
the [`allow_caps`][allow_caps] plugin option key in the client node's
configuration. For example:

```hcl
config {
cap_add = ["net_raw", "sys_time"]
}
```

- `cap_drop` - (Optional) A list of Linux capabilities as strings to pass directly to
[`--cap-drop`](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities).
Effective capabilities (computed from `cap_add` and `cap_drop`) have to match the configured allowlist.
The allowlist can be customized using the [`allow_caps`][allow_caps] plugin option key in the client node's configuration.
For example:
- `cap_drop` - (Optional) A list of Linux capabilities as strings to pass
directly to [`--cap-drop`][]. Effective capabilities (computed from `cap_add`
and `cap_drop`) must be a subset of the allowed capabilities configured with
the [`allow_caps`][allow_caps] plugin option key in the client node's
configuration. For example:

```hcl
config {
Expand Down Expand Up @@ -884,11 +884,14 @@ plugin "docker" {
"net_bind_service", "setfcap", "setgid", "setpcap", "setuid", "sys_chroot"]
```

which is the same list of capabilities allowed by [docker by default][docker_caps]
(without [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities can be obtained
by tasks using [`cap_add`][cap_add] and [`cap_drop`][cap_drop] options. Supports
the value `"all"` as a shortcut for allow-listing all capabilities supported by
the operating system.
which is the same list of capabilities allowed by [docker by
default][docker_caps] (without [`NET_RAW`][no_net_raw]). Allows the operator
to control which capabilities can be obtained by tasks using
[`cap_add`][cap_add] and [`cap_drop`][cap_drop] options. Supports the value
`"all"` as a shortcut for allow-listing all capabilities supported by the
operating system. Note that due to a limitation in Docker, tasks running as
non-root users cannot expand the capabilities set beyond the default. They can
only have their capabilities reduced.

!> **Warning:** Allowing more capabilities beyond the default may lead to
undesirable consequences, including untrusted tasks being able to compromise the
Expand Down Expand Up @@ -1219,4 +1222,6 @@ Windows is relatively new and rapidly evolving you may want to consult the
[`pids_limit`]: /nomad/docs/drivers/docker#pids_limit
[Windows isolation]: https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container
[cores]: /nomad/docs/job-specification/resources#cores
[runtime_env]: /nomad/docs/runtime/environment#job-related-variables
[runtime_env]: /nomad/docs/runtime/environment#job-related-variables
[`--cap-add`][](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities)
[`--cap-drop`][](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities)