Stack: Support cap_add, cap_drop and privileged on services

cli/compose/convert/service.go

@@ -14,6 +14,7 @@ import (
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/oci/caps"
 	"github.com/pkg/errors"
 )
 
@@ -117,6 +118,11 @@ func Service(
 		}
 	}
 
+	capabilities, err := convertCapabilities(apiVersion, service.CapAdd, service.CapDrop, service.Privileged)
+	if err != nil {
+		return swarm.ServiceSpec{}, err
+	}
+
 	serviceSpec := swarm.ServiceSpec{
 		Annotations: swarm.Annotations{
 			Name:   name,
@@ -147,6 +153,7 @@ func Service(
 				Isolation:       container.Isolation(service.Isolation),
 				Init:            service.Init,
 				Sysctls:         service.Sysctls,
+				Capabilities:    capabilities,
 			},
 			LogDriver:     logDriver,
 			Resources:     resources,
@@ -675,3 +682,18 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 	}
 	return &swarmCredSpec, nil
 }
+
+func convertCapabilities(apiVersion string, capAdd, capDrop []string, privileged bool) ([]string, error) {
+	capabilities := []string{}
+	if privileged || len(capAdd) > 0 || len(capDrop) > 0 {
+		if versions.LessThan(apiVersion, "1.41") {
+			return nil, errors.Errorf("Engine version does not support exact list of capabilities")
+		}
+		capabilities, err := caps.TweakCapabilities(caps.DefaultCapabilities(), capAdd, capDrop, nil, privileged)
+		if err != nil {
+			return nil, err
+		}
+		return capabilities, nil
+	}
+	return capabilities, nil
+}

cli/compose/convert/service_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/oci/caps"
 	"github.com/pkg/errors"
 	"gotest.tools/assert"
 	is "gotest.tools/assert/cmp"
@@ -623,3 +624,57 @@ func TestConvertUpdateConfigParallelism(t *testing.T) {
 	})
 	assert.Check(t, is.Equal(parallel, updateConfig.Parallelism))
 }
+
+func TestConvertServiceCapAddAndCapDrop(t *testing.T) {
+	result, err := Service("1.41", Namespace{name: "foo"}, composetypes.ServiceConfig{}, nil, nil, nil, nil)
+	assert.NilError(t, err)
+	assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.Capabilities, []string{}))
+
+	result, err = Service("1.40", Namespace{name: "foo"},
+		composetypes.ServiceConfig{CapAdd: []string{"SYS_NICE"}}, nil, nil, nil, nil)
+	assert.Error(t, err, "Engine version does not support exact list of capabilities")
+
+	service := composetypes.ServiceConfig{
+		CapAdd: []string{
+			"SYS_NICE",
+			"CAP_NET_ADMIN",
+		},
+		CapDrop: []string{
+			"CHOWN",
+			"DAC_OVERRIDE",
+			"CAP_FSETID",
+			"CAP_FOWNER",
+		},
+	}
+	expected := []string{
+		"CAP_MKNOD",
+		"CAP_NET_RAW",
+		"CAP_SETGID",
+		"CAP_SETUID",
+		"CAP_SETFCAP",
+		"CAP_SETPCAP",
+		"CAP_NET_BIND_SERVICE",
+		"CAP_SYS_CHROOT",
+		"CAP_KILL",
+		"CAP_AUDIT_WRITE",
+		"CAP_SYS_NICE",
+		"CAP_NET_ADMIN",
+	}
+	result, err = Service("1.41", Namespace{name: "foo"}, service, nil, nil, nil, nil)
+	assert.NilError(t, err)
+	assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.Capabilities, expected))
+}
+
+func TestConvertServicePrivileged(t *testing.T) {
+	service := composetypes.ServiceConfig{
+		Privileged: true,
+	}
+
+	result, err := Service("1.40", Namespace{name: "foo"}, service, nil, nil, nil, nil)
+	assert.Error(t, err, "Engine version does not support exact list of capabilities")
+
+	expected := caps.GetAllCapabilities()
+	result, err = Service("1.41", Namespace{name: "foo"}, service, nil, nil, nil, nil)
+	assert.NilError(t, err)
+	assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.Capabilities, expected))
+}

cli/compose/types/types.go

@@ -9,8 +9,6 @@ import (
 // UnsupportedProperties not yet supported by this implementation of the compose file
 var UnsupportedProperties = []string{
 	"build",
-	"cap_add",
-	"cap_drop",
 	"cgroupns_mode",
 	"cgroup_parent",
 	"devices",
@@ -21,7 +19,6 @@ var UnsupportedProperties = []string{
 	"mac_address",
 	"network_mode",
 	"pid",
-	"privileged",
 	"restart",
 	"security_opt",
 	"shm_size",