do we actually need cap_add, if yes, we could document on why and if not, remove it.

[may11544]

The first question: I see that the docker permission (cap_add) of graphd, storaged and metad has enabled SYS_PTRACE. Is this necessary, and can I ignore it.

The second question: Taking the storage configuration as an example, I see that for the http protocol, both the external port and the internal port are open, and they are 19779 and 19780 respectively. But for the rpc protocol, only the external port (9779) is open, but the internal port is not open. According to the official document, they are 9777, 9778 and 9780 respectively. May I ask if I should configure it where the port mapping is.

[wey-gu]

Thanks @may11544 for taking time feedback this :)

for the first one, we will revisit to see if we could get rid of it.

for the second one, it's reported here: vesoft-inc/nebula-docs-cn#2371

[yixinglu]

@may11544 If I remember correctly, the reason for the first question should be to allow developers to gdb the process inside the container. If you need not to debug something, I think you could disable the option.

[QingZ11]

@may11544 hi, I have noticed that the issue you created hasn’t been updated for nearly a month, is this issue been resolved? If not resolved, can you provide some more information? If solved, can you close this issue?

Thanks a lot for your contribution anyway 😊