Use capabilities in N310-based docker compose

- SA 2x2 tests on 60 and 100 MHz
- N310-based OAI gNB + UE

Give SYS_NICE and IPC_LOCK for performance. On the UE side, give
NET_ADMIN (for interface bringup) and NET_RAW (for ping an TUN).

ci-scripts/yaml_files/5g_sa_n310_2x2_100MHz/docker-compose.yml

@@ -1,9 +1,13 @@
 services:
     oai-gnb:
         image: oai-gnb:latest
-        privileged: true
         network_mode: "host"
         container_name: oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         environment:
             TZ: Europe/Paris
             USE_ADDITIONAL_OPTIONS: --log_config.global_log_options level,nocolor,time

ci-scripts/yaml_files/5g_sa_n310_2x2_60MHz/docker-compose.yml

@@ -1,9 +1,13 @@
 services:
     oai-gnb:
         image: oai-gnb:latest
-        privileged: true
         network_mode: "host"
         container_name: oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         environment:
             TZ: Europe/Paris
             USE_ADDITIONAL_OPTIONS: --log_config.global_log_options level,nocolor,time

ci-scripts/yaml_files/5g_sa_n310_gnb/docker-compose.yml

@@ -1,9 +1,13 @@
 services:
     oai-gnb:
         image: oai-gnb:latest
-        privileged: true
         network_mode: "host"
         container_name: oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:

ci-scripts/yaml_files/5g_sa_n310_nrue/docker-compose.yml

@@ -1,9 +1,17 @@
 services:
     oai-nr-ue:
         image: oai-nr-ue:latest
-        privileged: true
         network_mode: host
         container_name: oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
+            - SYS_NICE   # for performance
+            - IPC_LOCK   # for memory locking
+        devices:
+             - /dev/net/tun:/dev/net/tun
         ulimits:
           core: -1 # for core dumps
         #entrypoint: /bin/bash -c "sleep infinity"