cap-add NET_ADMIN

[gitdeath]

Services with cap-add NET_ADMIN do not restart with cap-add functions after being updated by Sheperd.

[djmaze]

That sounds like a docker bug to me.

@gitdeath Can you try just updating your service manually with docker service update --image=<IMAGE> <SERVICE> and see if the problem occurs as well?

[gitdeath]

This is how I've always done it in the past and it works just fine. I suspect is has something to do with shepherd being a container without capabilities. I will run shepherd with --cap-add=all and see if that allows this to work.

That sounds like a docker bug to me.

@gitdeath Can you try just updating your service manually with docker service update --image=<IMAGE> <SERVICE> and see if the problem occurs as well?

[gitdeath]

This is how I've always done it in the past and it works just fine. I suspect is has something to do with shepherd being a container without capabilities. I will run shepherd with --cap-add=all and see if that allows this to work.

That sounds like a docker bug to me.
@gitdeath Can you try just updating your service manually with docker service update --image=<IMAGE> <SERVICE> and see if the problem occurs as well?

Running Shepherd with --cap-add=all didn't help.

[djmaze]

Well.. You could also run the shepherd script directly on the host.. That should work in principle. Then you can see if it makes a difference.

[gitdeath]

I think I found the problem. The docker cli version in the container build doesn't meet the requirements to use --cap-add= in the command line.

bash-5.0# docker service update --cap-add=NET_ADMIN <service name>
unknown flag: --cap-add

bash-5.0# docker version
Client: Docker Engine - Community
 Version:           19.03.8

The required cli version is 20.10

[gitdeath]

Looks like this is due to Dockerhub environment variable setting for the ARM image.

ARM = ENV DOCKER_VERSION=19.03.8
ARM64 = ENV DOCKER_VERSION=20.10.7
AMD64 = ENV DOCKER_VERSION=20.10.7

[djmaze]

Ah, you are using it on ARM. Well.. That makes it a different story.

The official armhf docker builds have been broken since 19.03. And as far as I heard, it seems they won't be coming back.

That's why I built an image on my old arm machine manually some time ago. I guess we could use that for shepherd's armhf builds as well.

[gitdeath]

Well my fix was to redeploy my swarm as arm64. :-)

[djmaze]

FYI, mazzolino/shepherd:latest is now based on docker 20.10 on all architectures (including armhf).