Fixed error when program cannot start within container due to capabilities.

[alexey-milovidov]

For changelog. Remove if this is non-significant change.

Category (leave one):

• Build/Testing/Packaging Improvement

Short description (up to few sentences):
Fixed error when the server cannot start with the bash: /usr/bin/clickhouse-extract-from-config: Operation not permitted message within Docker or systemd-nspawn.

[filimonov]

But postinst is called one time during docker image preparation. And you can't run build with --privileged, so the resulting image will always have that capability disabled, and nobody except people building docker image (generally: you) will see that warning 'To enable taskstats accounting you may add the required capability later manually.'

So, for now, to make it work you need to

1. use docker run --cap-add=net_admin --cap-add=ipc_lock ...
2. at the same time enable it for clickhouse process inside the container (for example by adding one-liner shell script into initdb).

It looks like the second step is excessive and can be avoided.

1. It can be set up automatically by docker entypoint (which is executed every time when the container starts)
2. OR (better): effective capabilities detection can be improved. I have an impression that better detection is possible because capsh --print has no problems with that even inside docker, even without extra adjustments inside the container:

➜ docker run -it --rm --cap-add=net_admin --cap-add=ipc_lock ubuntu:precise bash -c 'apt-get update > /dev/null && apt-get install -y libcap2-bin > /dev/null && capsh --print'
debconf: delaying package configuration, since apt-utils is not installed
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+eip
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=0(root)
gid=0(root)
groups=

➜ docker run -it --rm ubuntu:precise bash -c 'apt-get update > /dev/null && apt-get install -y libcap2-bin > /dev/null && capsh --print'
debconf: delaying package configuration, since apt-utils is not installed
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+eip
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
uid=0(root)
gid=0(root)
groups=

Anyway information about proper way of running docker (with capabilities enabled) should be added to docker docs.

[alexey-milovidov]

Running docker with --cap-add is more obscure and non-obvious for end users. As these capabilities and corresponding features are optional, this solution is considered Ok.

We can re-work init script in Docker image to enable capabilities if available on startup.