Use capabilities in B200-based docker-compose

- sa_b200_gnb
- sa_aw2s_gnb
- sa_e1_b200
- sa_f1_b200
- sa_sc_b200_gnb
- nsa_b200_gnb

By default, the container has no access to /dev. Mount all USB devices
into the container to ease usability: by default, USB devices are
mounted under /dev/bus/usb using the bus ID, which is different on every
system and might change on reboots or with (un-)plugging USB devices.
Hence, mount all USB; the process has not many capabilities anyway, and
thus might not do much harm.

A proper solution would be to write a udev rule to mount a device using
its vendor and product ID, and only mount the corresponding device into
the container.

ci-scripts/yaml_files/sa_e1_b200_gnb/docker-compose.yml

@@ -1,8 +1,9 @@
 services:
     gnb_cucp:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-cucp-gnb
+        cap_drop:
+            - ALL
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -25,8 +26,12 @@ services:
 
     gnb_cuup:
         image: oai-nr-cuup:latest
-        privileged: true
         container_name: sa-cuup-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -48,8 +53,12 @@ services:
 
     gnb_du_tdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-du-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -61,9 +70,10 @@ services:
                                     --gNBs.[0].min_rxtxtime 2 --gNBs.[0].do_CSIRS 1 --gNBs.[0].do_SRS 1
                                     --RUs.[0].att_rx 14 --RUs.[0].att_tx 14
                                     --log_config.global_log_options level,nocolor,time,line_num,function
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb-du.sa.band78.106prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         # for performance reasons, we use host mode: in bridge mode, we have
         # unacceptable DL TCP performance. However, the whole point of
         # containerization is to not be in host mode, so update this to macvlan