Remove privileged flag for database and snmp docker #13783
Conversation
|
please identify reviewer for this pr. |
|
|
/azpw run Azure.sonic-buildimage |
|
/AzurePipelines run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run Azure.sonic-buildimage |
|
I retriggered another build: https://dev.azure.com/mssonic/build/_build/results?buildId=226231&view=results |
|
/azp run Azure.sonic-buildimage |
|
Commenter does not have sufficient privileges for PR 13783 in repo sonic-net/sonic-buildimage |
|
@andriydnvd I think you should run "azpw run Azure.sonic-buildimage" instead, only pr author can trigger the pipeline using "azpw" command. |
|
|
/azpw run Azure.sonic-buildimage |
|
/AzurePipelines run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
@qiluo-msft Passed after rebase onto upstream master |
|
I see some changes not related to database docker container. Could you merge latest master or rebase to latest master? |
Signed-off-by: Andriy Dobush <andriyd@nvidia.com>
Signed-off-by: Andriy Dobush <andriyd@nvidia.com>
andriydnvd
force-pushed
the
docker_hardening_priv
branch
from
c498438
to
448fd40
Compare
Hi, @qiluo-msft update branch. Pls check |
andriydnvd
changed the title
Done, thanks |
|
Ready for merger |
#### Why I did it Reduce docker privilege This is part of HLD sonic-net/SONiC#1364 #### How I did it Remove flag --privileged #### How to verify it docker exec -it database bash root@0048b82b460b:/# ip link add dummy0 type dummy RTNETLINK answers: Operation not permitted
…t#13783)" (sonic-net#16210) This reverts commit cf72683.
Signed-off-by: Andriy Dobush andriyd@nvidia.com
Why I did it
NOT FOR MERGE !!!!
Reduce docker privilege
This is part of HLD sonic-net/SONiC#1364
How I did it
Remove flag --privileged
How to verify it
docker exec -it database bash
root@0048b82b460b:/# ip link add dummy0 type dummy
RTNETLINK answers: Operation not permitted
Which release branch to backport (provide reason below if selected)
Description for the changelog
Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.
Link to config_db schema for YANG module changes
A picture of a cute animal (not mandatory but encouraged)