{"action":"created","issue":{"url":"https://api.github.com/repos/moby/moby/issues/25885","repository_url":"https://api.github.com/repos/moby/moby","labels_url":"https://api.github.com/repos/moby/moby/issues/25885/labels{/name}","comments_url":"https://api.github.com/repos/moby/moby/issues/25885/comments","events_url":"https://api.github.com/repos/moby/moby/issues/25885/events","html_url":"https://github.com/moby/moby/issues/25885","id":172192849,"node_id":"MDU6SXNzdWUxNzIxOTI4NDk=","number":25885,"title":"Missing from Swarmmode --cap-add ","user":{"login":"alexellis","id":6358735,"node_id":"MDQ6VXNlcjYzNTg3MzU=","avatar_url":"https://avatars1.githubusercontent.com/u/6358735?v=4","gravatar_id":"","url":"https://api.github.com/users/alexellis","html_url":"https://github.com/alexellis","followers_url":"https://api.github.com/users/alexellis/followers","following_url":"https://api.github.com/users/alexellis/following{/other_user}","gists_url":"https://api.github.com/users/alexellis/gists{/gist_id}","starred_url":"https://api.github.com/users/alexellis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexellis/subscriptions","organizations_url":"https://api.github.com/users/alexellis/orgs","repos_url":"https://api.github.com/users/alexellis/repos","events_url":"https://api.github.com/users/alexellis/events{/privacy}","received_events_url":"https://api.github.com/users/alexellis/received_events","type":"User","site_admin":false},"labels":[{"id":392678049,"node_id":"MDU6TGFiZWwzOTI2NzgwNDk=","url":"https://api.github.com/repos/moby/moby/labels/area/swarm","name":"area/swarm","color":"fbca04","default":false},{"id":179237356,"node_id":"MDU6TGFiZWwxNzkyMzczNTY=","url":"https://api.github.com/repos/moby/moby/labels/kind/enhancement","name":"kind/enhancement","color":"E8CAAF","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":46,"created_at":"2016-08-19T18:33:49Z","updated_at":"2018-10-25T10:42:36Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Some form of `--cap-add` or optional elevated privilege system would be required for accessing GPIO pins on ARM devices. Since ARM is becoming better supported by the Docker engine I would like to raise this to attention.\n\nWe tend to need to write to `/dev/mem` and there is currently a capability for that in \"regular flavoured swarm\".\n\nI would like to build out some IoT PoCs with Docker and swarmmode and support for this would really help. CC/ @DieterReuter @StefanScherer \n"},"comment":{"url":"https://api.github.com/repos/moby/moby/issues/comments/433002992","html_url":"https://github.com/moby/moby/issues/25885#issuecomment-433002992","issue_url":"https://api.github.com/repos/moby/moby/issues/25885","id":433002992,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzAwMjk5Mg==","user":{"login":"wanyvic","id":26783673,"node_id":"MDQ6VXNlcjI2NzgzNjcz","avatar_url":"https://avatars0.githubusercontent.com/u/26783673?v=4","gravatar_id":"","url":"https://api.github.com/users/wanyvic","html_url":"https://github.com/wanyvic","followers_url":"https://api.github.com/users/wanyvic/followers","following_url":"https://api.github.com/users/wanyvic/following{/other_user}","gists_url":"https://api.github.com/users/wanyvic/gists{/gist_id}","starred_url":"https://api.github.com/users/wanyvic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wanyvic/subscriptions","organizations_url":"https://api.github.com/users/wanyvic/orgs","repos_url":"https://api.github.com/users/wanyvic/repos","events_url":"https://api.github.com/users/wanyvic/events{/privacy}","received_events_url":"https://api.github.com/users/wanyvic/received_events","type":"User","site_admin":false},"created_at":"2018-10-25T10:42:36Z","updated_at":"2018-10-25T10:42:36Z","author_association":"NONE","body":"I found a solution to solve the problem.and I also can use cap_net_admin in swarm mode.\r\nyou could modify the runtime source code to add the capabilities what you need.(it will be a local default setting).\r\nfor example I add the CAP_NET_ADMIN to my runtime(used nvidia-container-runtime)\r\n[wanyvic/nvidia-container-runtime](https://github.com/wanyvic/nvidia-container-runtime/blob/master/runtime/runc/69663f0bd4b60df09991c08812a60108003fa340/0001-add-nvida-container-runtime-hook-add-default-cap_net.patch).\r\nAfter that rubuild it. started a container, input:\r\n `capsh --print` \r\nCAP_NET_ADMIN  can be found:\r\n`root@25303a54ebb3:/# capsh --print\r\nCurrent:=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+eip\r\nBounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap\r\nSecurebits: 00/0x0/1'b0\r\n secure-noroot: no (unlocked)\r\n secure-no-suid-fixup: no (unlocked)\r\n secure-keep-caps: no (unlocked)\r\nuid=0(root)\r\ngid=0(root)\r\ngroups=\r\nroot@25303a54ebb3:/# \r\n`\r\nthis method is not good.It also can't to set the `cap_add` or `cap_drop` in the docker-compose.yml.\r\nbut I can't find the other way to solve it."}}
{"actor":{"display_login":"wanyvic"}}