Documentation update for Docker --cap-add flag

[j7an]

Operating System: Linux host

The current --privileged flag is giving full access to the host. Could someone update the documentation with --cap-add flag for the actual host privileges needed to run the images for this repo? This will limit any security vulnerabilities that might exist within the image.

[budtmo]

Hi @j7an ,

It would be great if you could help us with it and create a PR.

[malletjo]

fyi, you can use --cap-add=SYS_ADMIN --device=/dev/bus/usb.

[budtmo]

Hi @malletjo ,

could you update documentation and create a PR?

[j7an]

@malletjo It looks like --cap-add=SYS_ADMIN is same as giving root access based on CAP_SYS_ADMIN: the new root. Are there other ones we can use as alternative?

[HasBert]

I also tried to not use the privileged mode and replace it with --cap-add=SYS_ADMIN, with --cap-add=NET_ADMIN, with --cap-add=SYS_MODULE and as @malletjo noted with --cap-add=SYS_ADMIN --device=/dev/bus/usb nothing worked for me. I'm not using a real device. Here is the official documentation of --cap-add.

Maybe it has something to do with the HAXM and KVM which are needed for virtualization and are only available on the host? Correct me if I'm wrong. Is there a place inside the docker container where the logs of the startup process are stored? I'd love to help, but I think I'm not quite as deep in this topic than you are.

[budtmo]

--privileged tag is not needed anymore. Please check the current documentation to run docker-android.