Add support for capabilities options in services

[olljanat]

- What I did
Add support for capabilities options in services

Third step to address #25885 , #24862 and moby/swarmkit#1030

- How I did it

• Increased API version 1.41
• Added Capabilities option
• Bump swarmkit

- How to verify it
Create service with command:

curl --unix-socket /var/run/docker.sock \
  --header "Content-Type: application/json" \
  --request POST \
  --data '{"Name":"test","TaskTemplate":{"ContainerSpec":{"Image":"ollijanatuinen/capsh","Capabilities":["CAP_NET_RAW","CAP_SYS_CHROOT"]}}}' \
  http://localhost/v1.41/services/create

Check log with command: docker logs <container id> which should print capabilities from inside of container.

Update capabilities

curl --unix-socket /var/run/docker.sock \
  --header "Content-Type: application/json" \
  --request POST \
  --data '{"Name":"test","TaskTemplate":{"ContainerSpec":{"Image":"ollijanatuinen/capsh","Capabilities":["CAP_MKNOD"]}}}}' \
  http://localhost/v1.41/services/test/update?version=7139

Reset to default capabilities:

curl --unix-socket /var/run/docker.sock \
  --header "Content-Type: application/json" \
  --request POST \
  --data '{"Name":"test","TaskTemplate":{"ContainerSpec":{"Image":"ollijanatuinen/capsh","Capabilities": null}}}}' \
  http://localhost/v1.41/services/test/update?version=7157

- A picture of a cute animal (not mandatory but encouraged)

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (master@cefc60c). Click here to learn what that means.
The diff coverage is 100%.

@@            Coverage Diff            @@
##             master   #39173   +/-   ##
=========================================
  Coverage          ?   37.05%           
=========================================
  Files             ?      612           
  Lines             ?    45484           
  Branches          ?        0           
=========================================
  Hits              ?    16852           
  Misses            ?    26347           
  Partials          ?     2285

[olljanat]

(reserved for my derek commands)

[GordonTheTurtle]

Please sign your commits following these rules:
https://github.com/moby/moby/blob/master/CONTRIBUTING.md#sign-your-work
The easiest way to do this is to amend the last commit:

$ git clone -b "25885-capabilities-swarm" git@github.com:olljanat/moby.git somewhere
$ cd somewhere
$ git rebase -i HEAD~842354127376
editor opens
change each 'pick' to 'edit'
save the file and quit
$ git commit --amend -s --no-edit
$ git rebase --continue # and repeat the amend for each commit
$ git push -f

Amending updates the existing PR. You DO NOT need to open a new one.

[thaJeztah]

Thanks! Left some comments inline 🤗

[olljanat]

@thaJeztah rebased and updated based on your comments. Janky should pass after #39277 is merged.

[thaJeztah]

LGTM

[DigitalTargit]

How would you use this from a compose-file that you pushed at a swarm using "docker stack deploy" ?

[thaJeztah]

Compose file changes are not yet implemented, but you'd specify the list of capabilities that a service should get

[olljanat]

Yea. That part probably needs still some discussion and actual implementation after that. For example if we will actually support "--privileged" switch like requested on moby/swarmkit#1030 and #24862 or will we up force user to specify exact list of capabilities? (it will be still possible to specify all the capabilities so it more about how we want to implement user interface).

[DigitalTargit]

uggg this question has no business here ... but how do I get this build for testing on Ubuntu 16.04 ...

cause for now I'll write a script that I push into my swarm nodes and "Update capabilities using curl" like your example above ...

[thaJeztah]

You can compile a static binary with make binary, which builds the daemon and stores it in bundles. You can stop your current daemon and replace it (but definitely only recommended for testing)

Otherwise wait for this to be merged, and it should appear as a nightly build on download.docker.com

[DigitalTargit]

Cool ... I cloned https://github.com/olljanat/moby.git ... and it built. Since you approved the change does this mean this change gets merged tonight and show up in tonights nightly build ? ... and seriously this goes without saying : you know you're one of the most helpful people this industry has ever seen even when the answer is not what people want to hear. Thank you.

[thaJeztah]

You make me blush! All credits for this one really go to @olljanat!

We generally want two maintainers to review and give their LGTM before we merge; to be sure that a reviewer didn't miss anything (we're human 😁).

That said; anyone can help (and is more than welcome) to review PRs (more eyes never hurt)

This PR is fairly straightforward, so once another maintainer finds time to review, I expect it to be merged soon

[DigitalTargit]

FYI ... I tried it out. I couldn't use it for what I was hoping to solve (using mongo with cifs remote storage). Azure just added NFS today so maybe that's an option but not sure the best driver to use for that.

BUT I did test it this PR (created a swarm with one service) and I do see the capabilities returned in the JSON. 👍 The credit does go to @olljanat

[kolyshkin]

LGTM