[docker-orchagent] limit privileged flag for swss container (sonic-ne…

…t#17598) [docker-orchagent] limit privileged flag for swss container Signed-off-by: Mai Bui <[email protected]>
bradh352 · Jan 2, 2025 · af1bf1d · af1bf1d
1 parent 393feb3
commit af1bf1d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/docker-orchagent.mk b/rules/docker-orchagent.mk
@@ -37,7 +37,7 @@ SONIC_BOOKWORM_DBG_DOCKERS += $(DOCKER_ORCHAGENT_DBG)
 SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_ORCHAGENT_DBG)
 
 $(DOCKER_ORCHAGENT)_CONTAINER_NAME = swss
-$(DOCKER_ORCHAGENT)_RUN_OPT += --privileged -t
+$(DOCKER_ORCHAGENT)_RUN_OPT += -t --cap-add=NET_ADMIN --security-opt apparmor=unconfined --security-opt="systempaths=unconfined"
 $(DOCKER_ORCHAGENT)_RUN_OPT += -v /etc/network/interfaces:/etc/network/interfaces:ro
 $(DOCKER_ORCHAGENT)_RUN_OPT += -v /etc/localtime:/etc/localtime:ro 
 $(DOCKER_ORCHAGENT)_RUN_OPT += -v /etc/network/interfaces.d/:/etc/network/interfaces.d/:ro