feat: Add support for --cap-drop#390
Open
ddl-ebrown wants to merge 1 commit into
Open
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
ddl-ebrown
force-pushed
the
add-support-for-cap-drop
branch
from
7af0286 to
b109714
Compare
ddl-ebrown
changed the title
Member
|
uh, sorry no one looked at this, I get to spend a little time now and then trying to maintain this, if you can rebase this and update it, I can merge it in. |
- Support for --cap-add was added as part of GoogleContainerTools#327 - This rounds out the feature set to also include support for --cap-drop - Updates tests to drop "chown" capability and verify doing so works - closes GoogleContainerTools#389
ddl-ebrown
force-pushed
the
add-support-for-cap-drop
branch
from
b109714 to
e3c9a68
Compare
Author
|
@loosebazooka updated |
loosebazooka
approved these changes
Feb 29, 2024
Author
|
Looks like we've got failing tests
Will take a closer look |
thomasdesr
added a commit
to anyscale/container-structure-test
that referenced
this pull request
Jun 30, 2026
When reconciling cap-drop (GoogleContainerTools#390) with the API-compat change (GoogleContainerTools#538), hostConfig set HostConfig.Capabilities = CapAdd alongside CapAdd/CapDrop. On Docker API >=1.40 the Capabilities field is mutually exclusive with CapAdd/CapDrop, so the daemon ignored CapDrop and dropped capabilities (e.g. chown) were not actually removed -- failing the 'Test Capabilities containerRunOptions' integration test. Drop the legacy Capabilities field; CapAdd (the GoogleContainerTools#538 fix) still makes caps work on modern daemons. Pre-1.40 daemons (Docker <19.03) are not supported.
thomasdesr
added a commit
to anyscale/container-structure-test
that referenced
this pull request
Jun 30, 2026
…stable The containeropts fixture set privileged:true alongside drop_capabilities:[chown] and excludedOutput .*chown.*. A privileged container receives the full capability set, so cap-drop is overridden and chown is always present -- the assertion could never pass (the upstream GoogleContainerTools#390 author had flagged this exact test failing). Remove privileged so cap-add (sys_admin) and cap-drop (chown) are exercised as intended.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Support for --cap-add was added as part of
add containerRunOptions #327
This rounds out the feature set to also include support for
--cap-drop
Updates tests to drop "chown" capability and verify doing so works
closes Add support to containerRunOptions for --cap-drop #389
FYI -
make testfails against the head of the main branch on my M1 -- which I didn't have time to diagnose. I'm using CI to verify that the tests behave properly.