Skip to content

Commit

Permalink
[docker-restapi] limit privileged flag for restapi container (#17138)
Browse files Browse the repository at this point in the history
Why I did it
HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking
Microsoft ADO (number only): 14807420
How I did it
Reduce linux capabilities in privileged flag

How to verify it
Run restapi sonic-mgmt tests on sn4600c
Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.
  • Loading branch information
maipbui authored Nov 21, 2023
1 parent 6dfaf5e commit 6ea03f9
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion rules/docker-restapi.mk
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_RESTAPI)
endif

$(DOCKER_RESTAPI)_CONTAINER_NAME = restapi
$(DOCKER_RESTAPI)_RUN_OPT += --cap-add NET_ADMIN --privileged -t
$(DOCKER_RESTAPI)_RUN_OPT += -t
$(DOCKER_RESTAPI)_RUN_OPT += -v /var/run/redis/redis.sock:/var/run/redis/redis.sock
$(DOCKER_RESTAPI)_RUN_OPT += -v /etc/sonic/credentials:/etc/sonic/credentials:ro
$(DOCKER_RESTAPI)_RUN_OPT += -p=8081:8081/tcp
Expand Down

0 comments on commit 6ea03f9

Please sign in to comment.