From 9dd52c9d440ecf9dc24783b151ecf7c6dcd068ae Mon Sep 17 00:00:00 2001 From: Robert Schmidt Date: Tue, 23 Apr 2024 07:53:31 +0200 Subject: [PATCH] Use capabilities in B200-based docker-compose - sa_b200_gnb - sa_aw2s_gnb - sa_e1_b200 - sa_f1_b200 - sa_sc_b200_gnb - nsa_b200_gnb By default, the container has no access to /dev. Mount all USB devices into the container to ease usability: by default, USB devices are mounted under /dev/bus/usb using the bus ID, which is different on every system and might change on reboots or with (un-)plugging USB devices. Hence, mount all USB; the process has not many capabilities anyway, and thus might not do much harm. A proper solution would be to write a udev rule to mount a device using its vendor and product ID, and only mount the corresponding device into the container. --- .../yaml_files/nsa_b200_gnb/docker-compose.yml | 9 +++++++-- .../yaml_files/sa_b200_gnb/docker-compose.yml | 9 +++++++-- .../sa_e1_b200_gnb/docker-compose.yml | 18 ++++++++++++++---- .../sa_f1_b200_gnb/docker-compose.yml | 12 +++++++++--- .../sa_sc_b200_gnb/docker-compose.yml | 9 +++++++-- 5 files changed, 44 insertions(+), 13 deletions(-) diff --git a/ci-scripts/yaml_files/nsa_b200_gnb/docker-compose.yml b/ci-scripts/yaml_files/nsa_b200_gnb/docker-compose.yml index fa5f9b0a28..290ba46280 100644 --- a/ci-scripts/yaml_files/nsa_b200_gnb/docker-compose.yml +++ b/ci-scripts/yaml_files/nsa_b200_gnb/docker-compose.yml @@ -1,16 +1,21 @@ services: gnb_mono_tdd: image: oai-gnb:latest - privileged: true container_name: nsa-b200-gnb + cap_drop: + - ALL + cap_add: + - SYS_NICE + - IPC_LOCK ulimits: core: -1 # for core dumps environment: USE_B2XX: 'yes' USE_ADDITIONAL_OPTIONS: -E -q --RUs.[0].sdr_addrs serial=30C51D4 --continuous-tx --log_config.global_log_options level,nocolor,time,line_num,function + devices: + - /dev/bus/usb/:/dev/bus/usb/ volumes: - ../../conf_files/gnb.nsa.band78.106prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf - - /dev:/dev networks: public_net: ipv4_address: 192.168.68.194 diff --git a/ci-scripts/yaml_files/sa_b200_gnb/docker-compose.yml b/ci-scripts/yaml_files/sa_b200_gnb/docker-compose.yml index e440cec52d..d97daf49d1 100644 --- a/ci-scripts/yaml_files/sa_b200_gnb/docker-compose.yml +++ b/ci-scripts/yaml_files/sa_b200_gnb/docker-compose.yml @@ -1,16 +1,21 @@ services: gnb_mono_tdd: image: oai-gnb:latest - privileged: true container_name: sa-b200-gnb + cap_drop: + - ALL + cap_add: + - SYS_NICE + - IPC_LOCK ulimits: core: -1 # for core dumps environment: USE_B2XX: 'yes' USE_ADDITIONAL_OPTIONS: --sa --RUs.[0].sdr_addrs serial=30C51D4 --telnetsrv --telnetsrv.shrmod ci --continuous-tx --log_config.global_log_options level,nocolor,time,line_num,function + devices: + - /dev/bus/usb/:/dev/bus/usb/ volumes: - ../../conf_files/gnb.sa.band78.51prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf - - /dev:/dev # for performance reasons, we use host mode: in bridge mode, we have # unacceptable DL TCP performance. However, the whole point of # containerization is to not be in host mode, so update this to macvlan diff --git a/ci-scripts/yaml_files/sa_e1_b200_gnb/docker-compose.yml b/ci-scripts/yaml_files/sa_e1_b200_gnb/docker-compose.yml index 7798d41c88..4c2d0b7cc9 100644 --- a/ci-scripts/yaml_files/sa_e1_b200_gnb/docker-compose.yml +++ b/ci-scripts/yaml_files/sa_e1_b200_gnb/docker-compose.yml @@ -1,8 +1,9 @@ services: gnb_cucp: image: oai-gnb:latest - privileged: true container_name: sa-cucp-gnb + cap_drop: + - ALL ulimits: core: -1 # for core dumps environment: @@ -25,8 +26,12 @@ services: gnb_cuup: image: oai-nr-cuup:latest - privileged: true container_name: sa-cuup-gnb + cap_drop: + - ALL + cap_add: + - SYS_NICE + - IPC_LOCK ulimits: core: -1 # for core dumps environment: @@ -48,8 +53,12 @@ services: gnb_du_tdd: image: oai-gnb:latest - privileged: true container_name: sa-du-b200-gnb + cap_drop: + - ALL + cap_add: + - SYS_NICE + - IPC_LOCK ulimits: core: -1 # for core dumps environment: @@ -61,9 +70,10 @@ services: --gNBs.[0].min_rxtxtime 2 --gNBs.[0].do_CSIRS 1 --gNBs.[0].do_SRS 1 --RUs.[0].att_rx 14 --RUs.[0].att_tx 14 --log_config.global_log_options level,nocolor,time,line_num,function + devices: + - /dev/bus/usb/:/dev/bus/usb/ volumes: - ../../conf_files/gnb-du.sa.band78.106prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf - - /dev:/dev # for performance reasons, we use host mode: in bridge mode, we have # unacceptable DL TCP performance. However, the whole point of # containerization is to not be in host mode, so update this to macvlan diff --git a/ci-scripts/yaml_files/sa_f1_b200_gnb/docker-compose.yml b/ci-scripts/yaml_files/sa_f1_b200_gnb/docker-compose.yml index b2f682aada..8f026245ac 100644 --- a/ci-scripts/yaml_files/sa_f1_b200_gnb/docker-compose.yml +++ b/ci-scripts/yaml_files/sa_f1_b200_gnb/docker-compose.yml @@ -1,8 +1,9 @@ services: gnb_cu: image: oai-gnb:latest - privileged: true container_name: sa-cu-gnb + cap_drop: + - ALL ulimits: core: -1 # for core dumps environment: @@ -26,8 +27,12 @@ services: gnb_du_fdd: image: oai-gnb:latest - privileged: true container_name: sa-du-b200-gnb + cap_drop: + - ALL + cap_add: + - SYS_NICE + - IPC_LOCK ulimits: core: -1 # for core dumps environment: @@ -36,9 +41,10 @@ services: --telnetsrv --telnetsrv.listenport 9091 --telnetsrv.shrmod ci --gNBs.[0].min_rxtxtime 2 --gNBs.[0].do_CSIRS 1 --gNBs.[0].do_SRS 0 --L1s.[0].max_ldpc_iterations 20 --log_config.global_log_options level,nocolor,time,line_num,function + devices: + - /dev/bus/usb/:/dev/bus/usb/ volumes: - ../../conf_files/gnb-du.sa.band1.52prb.usrpb210.conf:/opt/oai-gnb/etc/gnb.conf - - /dev:/dev # for performance reasons, we use host mode: in bridge mode, we have # unacceptable DL TCP performance. However, the whole point of # containerization is to not be in host mode, so update this to macvlan diff --git a/ci-scripts/yaml_files/sa_sc_b200_gnb/docker-compose.yml b/ci-scripts/yaml_files/sa_sc_b200_gnb/docker-compose.yml index 7bd0f03b10..4ec5900521 100644 --- a/ci-scripts/yaml_files/sa_sc_b200_gnb/docker-compose.yml +++ b/ci-scripts/yaml_files/sa_sc_b200_gnb/docker-compose.yml @@ -1,16 +1,21 @@ services: gnb_mono_tdd: image: oai-gnb:latest - privileged: true container_name: sa-b200-gnb + cap_drop: + - ALL + cap_add: + - SYS_NICE + - IPC_LOCK ulimits: core: -1 # for core dumps environment: USE_B2XX: 'yes' USE_ADDITIONAL_OPTIONS: --sa --RUs.[0].sdr_addrs serial=30C51D4 --telnetsrv --telnetsrv.shrmod ci --continuous-tx --log_config.global_log_options level,nocolor,time,line_num,function -E + devices: + - /dev/bus/usb/:/dev/bus/usb/ volumes: - ../../conf_files/gnb.sa.band78.106prb.usrpb200.sc-fdma.conf:/opt/oai-gnb/etc/gnb.conf - - /dev:/dev # for performance reasons, we use host mode: in bridge mode, we have # unacceptable DL TCP performance. However, the whole point of # containerization is to not be in host mode, so update this to macvlan