Background: I am running a docker container which needs to load/remove a kernel module which makes USB devices attached to a remote server available on the host which I then want to make available in the container.
It works when running the container with —-privileged and bind mounts for /lib/modules and /dev.
Now I want to remove privileged mode and just allow the minimum necessary access. I tried —-cap-add=all as a start, but that doesn’t seem enough. What else does —-privileged allow?
Setting privileged should modify:
That's from memory, I might be able to find some more digging in the code if this doesn't point you too your issue.
p.s. here is a link to the documentation on what --privileged does: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities