Use capabilities in B200-based docker-compose

- sa_b200_gnb
- sa_aw2s_gnb
- sa_e1_b200
- sa_f1_b200
- sa_sc_b200_gnb
- nsa_b200_gnb

By default, the container has no access to /dev. Mount all USB devices
into the container to ease usability: by default, USB devices are
mounted under /dev/bus/usb using the bus ID, which is different on every
system and might change on reboots or with (un-)plugging USB devices.
Hence, mount all USB; the process has not many capabilities anyway, and
thus might not do much harm.

A proper solution would be to write a udev rule to mount a device using
its vendor and product ID, and only mount the corresponding device into
the container.

ci-scripts/yaml_files/sa_f1_b200_gnb/docker-compose.yml

@@ -1,8 +1,9 @@
 services:
     gnb_cu:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-cu-gnb
+        cap_drop:
+            - ALL
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -26,8 +27,12 @@ services:
 
     gnb_du_fdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-du-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -36,9 +41,10 @@ services:
                                     --telnetsrv --telnetsrv.listenport 9091 --telnetsrv.shrmod ci
                                     --gNBs.[0].min_rxtxtime 2 --gNBs.[0].do_CSIRS 1 --gNBs.[0].do_SRS 0 --L1s.[0].max_ldpc_iterations 20
                                     --log_config.global_log_options level,nocolor,time,line_num,function
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb-du.sa.band1.52prb.usrpb210.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         # for performance reasons, we use host mode: in bridge mode, we have
         # unacceptable DL TCP performance. However, the whole point of
         # containerization is to not be in host mode, so update this to macvlan