Option to set kernel capabilities on service update

.github/workflows/e2e.yml

@@ -21,6 +21,18 @@ on:
 jobs:
   e2e:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        service:
+          - date
+          - sleep
+          - error
+          - configs
+          - global
+          - more_replicas
+          - query
+          - cap
     steps:
       -
         name: Checkout
@@ -34,7 +46,7 @@ jobs:
           echo ::set-output name=build_tag::swarm-cronjob:local
           echo ::set-output name=service_name::swarm-cronjob
           echo ::set-output name=running_timeout::120
-          echo ::set-output name=running_log_check::Number of cronjob tasks: 7
+          echo ::set-output name=running_log_check::Number of cronjob tasks: 1
       -
         name: Set up QEMU
         uses: docker/setup-qemu-action@v2
@@ -52,15 +64,9 @@ jobs:
           docker swarm leave --force > /dev/null 2>&1 || true
           docker swarm init --advertise-addr $(dig +short myip.opendns.com @resolver1.opendns.com)
       -
-        name: Swarm deploy stacks
+        name: Swarm deploy stack
         run: |
-          docker stack deploy date -c test/date.yml
-          docker stack deploy sleep -c test/sleep.yml
-          docker stack deploy error -c test/error.yml
-          docker stack deploy configs -c test/configs.yml
-          docker stack deploy global -c test/global.yml
-          docker stack deploy more_replicas -c test/more_replicas.yml
-          docker stack deploy query -c test/query.yml
+          docker stack deploy ${{ matrix.service }} -c test/${{ matrix.service }}.yml
       -
         name: Create service
         run: |
@@ -86,4 +92,7 @@ jobs:
               exit 1
             fi
           done < <(docker service logs -f ${{ steps.prep.outputs.service_name }} 2>&1)
-          docker swarm leave --force > /dev/null 2>&1 || true
+      -
+        name: Service logs
+        run: |
+          docker service logs ${{ matrix.service }}_test

docs/usage/docker-labels.md

@@ -10,3 +10,4 @@ You can configure your service using swarm-cronjob through Docker labels:
 | `swarm.cronjob.replicas`       | `1`     | Number of replicas to set on schedule in `replicated` mode.                                                        |
 | `swarm.cronjob.registry-auth`  | `false` | Send registry authentication details to Swarm agents.                                                              |
 | `swarm.cronjob.query-registry` |         | Indicates whether the service update requires contacting a registry                                                |
+| `swarm.cronjob.capabilities`   |         | Comma separated list of kernel capabilities to add to the default set when service is updated                      |

internal/app/app.go

@@ -3,14 +3,15 @@ package app
 import (
 	"context"
 	"strconv"
+	"strings"
 
 	"github.com/crazy-max/swarm-cronjob/internal/docker"
 	"github.com/crazy-max/swarm-cronjob/internal/model"
 	"github.com/crazy-max/swarm-cronjob/internal/worker"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/mitchellh/mapstructure"
-	"github.com/robfig/cron/v3"
+	cron "github.com/robfig/cron/v3"
 	"github.com/rs/zerolog/log"
 )
 
@@ -157,6 +158,8 @@ func (sc *SwarmCronjob) crudJob(serviceName string) (bool, error) {
 				log.Error().Str("service", service.Name).Err(err).Msgf("Cannot parse %s value of label %s", labelValue, labelKey)
 			}
 			wc.Job.QueryRegistry = &queryRegistry
+		case "swarm.cronjob.capabilities":
+			wc.Job.Capabilities = strings.Split(labelValue, ",")
 		case "swarm.cronjob.scaledown":
 			if labelValue == "true" {
 				log.Debug().Str("service", service.Name).Msg("Scale down detected. Skipping cronjob")

internal/model/worker.go

@@ -8,5 +8,6 @@ type Job struct {
 	SkipRunning   bool
 	RegistryAuth  bool
 	QueryRegistry *bool
+	Capabilities  []string
 	Replicas      uint64
 }

internal/worker/worker.go

@@ -66,6 +66,12 @@ func (c *Client) Run() {
 	// Set ForceUpdate with Version to ensure update
 	serviceUp.Spec.TaskTemplate.ForceUpdate = serviceUp.Version.Index
 
+	// Add capabilities
+	if len(c.Job.Capabilities) > 0 {
+		log.Debug().Str("service", c.Job.Name).Strs("capabilities", c.Job.Capabilities).Msg("Set capabilities")
+		serviceUp.Spec.TaskTemplate.ContainerSpec.CapabilityAdd = c.Job.Capabilities
+	}
+
 	// Update options
 	updateOpts := types.ServiceUpdateOptions{}
 	if c.Job.RegistryAuth {

test/cap.yml

@@ -0,0 +1,14 @@
+version: "3.8"
+
+services:
+  test:
+    image: alpine:edge
+    command: >
+      /bin/sh -c "apk add libcap-utils && capsh --print | grep Current: | cut -d' ' -f2"
+    deploy:
+      replicas: 0
+      labels:
+        - "swarm.cronjob.enable=true"
+        - "swarm.cronjob.schedule=*/5 * * * * *"
+        - "swarm.cronjob.skip-running=true"
+        - "swarm.cronjob.capabilities=NET_ADMIN"