Sets cap_net_raw capability on packet-headers binary

This allows the pod to run as a non-root user with no special capabilities.
m-lab · Apr 7, 2023 · 2fce1bf · 2fce1bf
1 parent fce28bd
commit 2fce1bf
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -10,7 +10,8 @@ RUN chmod a+rx /go/bin/packet-headers
 
 # Put it in its own image.
 FROM alpine:3.16
-RUN apk --no-cache add libpcap
+RUN apk --no-cache add libpcap libcap
 COPY --from=build /go/bin/packet-headers /packet-headers
+RUN setcap cap_net_raw=ep /packet-headers
 WORKDIR /
 ENTRYPOINT ["/packet-headers"]