remove priv

Signed-off-by: Mai Bui <[email protected]>
sonic-net · Sep 7, 2023 · bb03dd9 · bb03dd9
1 parent 2f69a0e
commit bb03dd9
Show file tree

Hide file tree

Showing 7 changed files with 7 additions and 7 deletions.
diff --git a/rules/docker-eventd.mk b/rules/docker-eventd.mk
@@ -31,7 +31,7 @@ SONIC_DOCKER_DBG_IMAGES += $(DOCKER_EVENTD_DBG)
 SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_EVENTD_DBG)
 
 $(DOCKER_EVENTD)_CONTAINER_NAME = eventd
-$(DOCKER_EVENTD)_RUN_OPT += --privileged -t
+$(DOCKER_EVENTD)_RUN_OPT += -t
 $(DOCKER_EVENTD)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_EVENTD)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro 
 

diff --git a/rules/docker-iccpd.mk b/rules/docker-iccpd.mk
@@ -21,7 +21,7 @@ SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_ICCPD_DBG)
 endif
 
 $(DOCKER_ICCPD)_CONTAINER_NAME = iccpd
-$(DOCKER_ICCPD)_RUN_OPT += --privileged -t
+$(DOCKER_ICCPD)_RUN_OPT += -t
 $(DOCKER_ICCPD)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_ICCPD)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro 
 

diff --git a/rules/docker-macsec.mk b/rules/docker-macsec.mk
@@ -38,7 +38,7 @@ endif
 $(DOCKER_MACSEC)_CONTAINER_NAME = macsec
 $(DOCKER_MACSEC)_VERSION = 1.0.0
 $(DOCKER_MACSEC)_PACKAGE_NAME = macsec
-$(DOCKER_MACSEC)_RUN_OPT += --privileged -t
+$(DOCKER_MACSEC)_RUN_OPT += -t
 $(DOCKER_MACSEC)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_MACSEC)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro 
 $(DOCKER_MACSEC)_RUN_OPT += -v /host/warmboot:/var/warmboot

diff --git a/rules/docker-mux.mk b/rules/docker-mux.mk
@@ -30,7 +30,7 @@ SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_MUX_DBG)
 endif
 
 $(DOCKER_MUX)_CONTAINER_NAME = mux
-$(DOCKER_MUX)_RUN_OPT += --privileged -t
+$(DOCKER_MUX)_RUN_OPT += -t --cap-add=NET_ADMIN
 $(DOCKER_MUX)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_MUX)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro 
 $(DOCKER_MUX)_FILES += $(SUPERVISOR_PROC_EXIT_LISTENER_SCRIPT)
diff --git a/rules/docker-nat.mk b/rules/docker-nat.mk
@@ -29,7 +29,7 @@ SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_NAT_DBG)
 endif
 
 $(DOCKER_NAT)_CONTAINER_NAME = nat
-$(DOCKER_NAT)_RUN_OPT += --privileged -t
+$(DOCKER_NAT)_RUN_OPT += -t
 $(DOCKER_NAT)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_NAT)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro 
 $(DOCKER_NAT)_RUN_OPT += -v /host/warmboot:/var/warmboot

diff --git a/rules/docker-restapi.mk b/rules/docker-restapi.mk
@@ -19,7 +19,7 @@ SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_RESTAPI)
 endif
 
 $(DOCKER_RESTAPI)_CONTAINER_NAME = restapi
-$(DOCKER_RESTAPI)_RUN_OPT += --cap-add NET_ADMIN --privileged -t
+$(DOCKER_RESTAPI)_RUN_OPT += -t
 $(DOCKER_RESTAPI)_RUN_OPT += -v /var/run/redis/redis.sock:/var/run/redis/redis.sock
 $(DOCKER_RESTAPI)_RUN_OPT += -v /etc/sonic/credentials:/etc/sonic/credentials:ro
 $(DOCKER_RESTAPI)_RUN_OPT += -p=8081:8081/tcp

diff --git a/rules/docker-sonic-mgmt-framework.mk b/rules/docker-sonic-mgmt-framework.mk
@@ -29,7 +29,7 @@ SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_MGMT_FRAMEWORK_DBG)
 endif
 
 $(DOCKER_MGMT_FRAMEWORK)_CONTAINER_NAME = mgmt-framework
-$(DOCKER_MGMT_FRAMEWORK)_RUN_OPT += --privileged -t
+$(DOCKER_MGMT_FRAMEWORK)_RUN_OPT += -t
 $(DOCKER_MGMT_FRAMEWORK)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_MGMT_FRAMEWORK)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro 
 $(DOCKER_MGMT_FRAMEWORK)_RUN_OPT += -v /etc:/host_etc:ro