[docker-database] limit privileged flag for database container

Signed-off-by: Mai Bui <[email protected]>
sonic-net · Jun 10, 2024 · f541d5f · f541d5f
1 parent 6968aaa
commit f541d5f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/docker-database.mk b/rules/docker-database.mk
@@ -28,7 +28,7 @@ SONIC_BOOKWORM_DBG_DOCKERS += $(DOCKER_DATABASE_DBG)
 SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_DATABASE_DBG)
 
 $(DOCKER_DATABASE)_CONTAINER_NAME = database
-$(DOCKER_DATABASE)_RUN_OPT += --privileged -t
+$(DOCKER_DATABASE)_RUN_OPT += -t --cap-add=ALL --security-opt label=disable --security-opt apparmor=unconfined --security-opt="systempaths=unconfined"
 $(DOCKER_DATABASE)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
 $(DOCKER_DATABASE)_RUN_OPT += -v /etc/timezone:/etc/timezone:ro