feat(ng): manage container capabilities in ng state

docker/compose/ng.sls

@@ -55,6 +55,18 @@ docker-compose-ng-{{ id }}-running:
         - {{ variable }}: {{ value }}
             {%- endfor %}
         {%- endif %}
+        {%- if 'cap_drop' in container and container.cap_drop is iterable %}
+    - cap_drop:
+            {%- for cap in container.cap_drop %}
+        - {{ cap }}
+            {%- endfor %}
+        {%- endif %}
+        {%- if 'cap_add' in container and container.cap_add is iterable %}
+    - cap_add:
+            {%- for cap in container.cap_add %}
+        - {{ cap }}
+            {%- endfor %}
+        {%- endif %}
         {%- if 'ports' in container and container.ports is iterable %}
     - port_bindings:
             {%- for port_mapping in container.ports %}

docs/README.rst

@@ -187,6 +187,11 @@ To use this formula, you might target a host with the following pillar:
               STORAGE_PATH: *datapath
               SEARCH_BACKEND: 'sqlalchemy'
               REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: '/registry'
+            cap_add:
+              - ALL
+            cap_drop:
+              - NET_ADMIN
+              - SYS_ADMIN
             ports:
               - 127.0.0.1:5000:5000
             # restart: 'always'    # compose v1.9

pillar.example

@@ -121,6 +121,11 @@ docker:
           STORAGE_PATH: *datapath
           SEARCH_BACKEND: 'sqlalchemy'
           REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: '/registry'
+        cap_add:
+          - ALL
+        cap_drop:
+          - NET_ADMIN
+          - SYS_ADMIN
         ports:
           - 127.0.0.1:5000:5000
         # restart: 'always'    # compose v1.9