add cap_net_admin in the container image and dissable apparmor since …

…it may not be universally supported (#14)
gravitational · May 14, 2019 · 2225c0b · 2225c0b
1 parent 4bec9ed
commit 2225c0b
Show file tree

Hide file tree

Showing 3 changed files with 1 addition and 2 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -57,4 +57,5 @@ RUN mkdir -p /opt/cni/bin && curl -L --retry 5 https://github.com/containernetwo
 
 
 ADD build/wormhole /wormhole
+RUN setcap cap_net_admin=+ep /wormhole && setcap cap_net_raw=+ep /wormhole
 CMD ["/wormhole"]  
diff --git a/docs/generic-wormhole.yaml b/docs/generic-wormhole.yaml
@@ -190,7 +190,6 @@ spec:
         k8s-app: wormhole
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
-        container.apparmor.security.beta.kubernetes.io/wormhole: runtime/default
         seccomp.security.alpha.kubernetes.io/pod: runtime/default
     spec:
       hostNetwork: true

diff --git a/docs/gravity-wormhole.yaml b/docs/gravity-wormhole.yaml
@@ -155,7 +155,6 @@ spec:
         k8s-app: wormhole
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
-        container.apparmor.security.beta.kubernetes.io/wormhole: runtime/default
         seccomp.security.alpha.kubernetes.io/pod: runtime/default
     spec:
       hostNetwork: true