drop NET_RAW from all containers

Signed-off-by: Simon L <[email protected]>
nextcloud · Sep 20, 2023 · bcced0b · bcced0b
1 parent 133a750
commit bcced0b
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php
@@ -476,6 +476,9 @@ public function CreateContainer(Container $container) : void {
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
+        // Disable arp spoofing
+        $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
+
         if ($container->isApparmorUnconfined()) {
             $requestBody['HostConfig']['SecurityOpt'] = ["apparmor:unconfined"];
         }