Repository: ansible/ansible

Issue:
docker_container - missing cap_drop
From @gtirloni on 2016-10-17T15:15:06Z
##### ISSUE TYPE
- Feature Idea
##### COMPONENT NAME

docker_container module
##### ANSIBLE VERSION

ansible 2.1.2.0
##### SUMMARY

docker_container module does not support removing capabilities (i.e. docker --cap-drop option). 

cap_drop and cap_add were added to the docker module in ansible 2.0 but that module is marked as deprecated now.

Copied from original issue: ansible/ansible-modules-core#5286



Discussion:
From @ansibot on 2016-10-17T15:15:06Z

<!-- @gtirloni: Thanks for filing this feature idea! -->

@ansible ping, this issue is waiting for your response.
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)

<!--- boilerplate: issue_bug_new --->

From @smuthali on 2016-10-17T15:15:06Z

This affects Ansible 2.2 as well
cc @ThomasSteinbach @cove @dusdanig @jctanner @kassiansun @softzilla @zfil
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
cc @chouseknecht @joshuaconner
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
Is there some philosophical basis for supporting cap add but not drop? If not I'll start on a patch ...
@jstephenson no, just because docker add too many command line options since `docker_container` added...

Resolving patch:
diff --git a/lib/ansible/modules/cloud/docker/docker_container.py b/lib/ansible/modules/cloud/docker/docker_container.py
--- a/lib/ansible/modules/cloud/docker/docker_container.py
+++ b/lib/ansible/modules/cloud/docker/docker_container.py
@@ -37,6 +37,10 @@
   capabilities:
     description:
       - List of capabilities to add to the container.
+  cap_drop:
+    description:
+      - List of capabilities to drop from the container.
+    version_added: "2.7"
   cleanup:
     description:
       - Use with I(detach=false) to remove the container after successful execution.
@@ -539,6 +543,15 @@
     name: sleepy
     purge_networks: yes
 
+- name: Create a container with limited capabilities
+  docker_container:
+    name: sleepy
+    image: ubuntu:16.04
+    command: sleep infinity
+    capabilities:
+      - sys_time
+    cap_drop:
+      - all
 '''
 
 RETURN = '''
@@ -626,6 +639,7 @@ def __init__(self, client):
         self.auto_remove = None
         self.blkio_weight = None
         self.capabilities = None
+        self.cap_drop = None
         self.cleanup = None
         self.command = None
         self.cpu_period = None
@@ -875,6 +889,7 @@ def _host_config(self):
             network_mode='network_mode',
             userns_mode='userns_mode',
             cap_add='capabilities',
+            cap_drop='cap_drop',
             extra_hosts='etc_hosts',
             read_only='read_only',
             ipc_mode='ipc_mode',
@@ -1969,6 +1984,7 @@ def main():
         auto_remove=dict(type='bool', default=False),
         blkio_weight=dict(type='int'),
         capabilities=dict(type='list'),
+        cap_drop=dict(type='list'),
         cleanup=dict(type='bool', default=False),
         command=dict(type='raw'),
         cpu_period=dict(type='int'),


Test patch: