From ffa5ba400af47a70c1dd384c1686911d01bc78c6 Mon Sep 17 00:00:00 2001
From: Robert Schmidt <robert.schmidt@openairinterface.org>
Date: Mon, 22 Apr 2024 17:12:34 +0200
Subject: [PATCH] Use capabilities in N310-based docker compose

- SA 2x2 tests on 60 and 100 MHz
- N310-based OAI gNB + UE

Give SYS_NICE and IPC_LOCK for performance. On the UE side, give
NET_ADMIN (for interface bringup) and NET_RAW (for ping an TUN).
---
 .../5g_sa_n310_2x2_100MHz/docker-compose.yml           |  6 +++++-
 .../yaml_files/5g_sa_n310_2x2_60MHz/docker-compose.yml |  6 +++++-
 .../yaml_files/5g_sa_n310_gnb/docker-compose.yml       |  6 +++++-
 .../yaml_files/5g_sa_n310_nrue/docker-compose.yml      | 10 +++++++++-
 4 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/ci-scripts/yaml_files/5g_sa_n310_2x2_100MHz/docker-compose.yml b/ci-scripts/yaml_files/5g_sa_n310_2x2_100MHz/docker-compose.yml
index 9be2d550c0..9368957b03 100644
--- a/ci-scripts/yaml_files/5g_sa_n310_2x2_100MHz/docker-compose.yml
+++ b/ci-scripts/yaml_files/5g_sa_n310_2x2_100MHz/docker-compose.yml
@@ -1,9 +1,13 @@
 services:
     oai-gnb:
         image: oai-gnb:latest
-        privileged: true
         network_mode: "host"
         container_name: oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         environment:
             TZ: Europe/Paris
             USE_ADDITIONAL_OPTIONS: --log_config.global_log_options level,nocolor,time
diff --git a/ci-scripts/yaml_files/5g_sa_n310_2x2_60MHz/docker-compose.yml b/ci-scripts/yaml_files/5g_sa_n310_2x2_60MHz/docker-compose.yml
index d970d96e33..efe9f03c36 100644
--- a/ci-scripts/yaml_files/5g_sa_n310_2x2_60MHz/docker-compose.yml
+++ b/ci-scripts/yaml_files/5g_sa_n310_2x2_60MHz/docker-compose.yml
@@ -1,9 +1,13 @@
 services:
     oai-gnb:
         image: oai-gnb:latest
-        privileged: true
         network_mode: "host"
         container_name: oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         environment:
             TZ: Europe/Paris
             USE_ADDITIONAL_OPTIONS: --log_config.global_log_options level,nocolor,time
diff --git a/ci-scripts/yaml_files/5g_sa_n310_gnb/docker-compose.yml b/ci-scripts/yaml_files/5g_sa_n310_gnb/docker-compose.yml
index 625308d863..31a0532d2e 100644
--- a/ci-scripts/yaml_files/5g_sa_n310_gnb/docker-compose.yml
+++ b/ci-scripts/yaml_files/5g_sa_n310_gnb/docker-compose.yml
@@ -1,9 +1,13 @@
 services:
     oai-gnb:
         image: oai-gnb:latest
-        privileged: true
         network_mode: "host"
         container_name: oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
diff --git a/ci-scripts/yaml_files/5g_sa_n310_nrue/docker-compose.yml b/ci-scripts/yaml_files/5g_sa_n310_nrue/docker-compose.yml
index 388e5a5feb..c427a5ef4c 100644
--- a/ci-scripts/yaml_files/5g_sa_n310_nrue/docker-compose.yml
+++ b/ci-scripts/yaml_files/5g_sa_n310_nrue/docker-compose.yml
@@ -1,9 +1,17 @@
 services:
     oai-nr-ue:
         image: oai-nr-ue:latest
-        privileged: true
         network_mode: host
         container_name: oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
+            - SYS_NICE   # for performance
+            - IPC_LOCK   # for memory locking
+        devices:
+             - /dev/net/tun:/dev/net/tun
         ulimits:
           core: -1 # for core dumps
         #entrypoint: /bin/bash -c "sleep infinity"