Use capabilities in 5G RFsim docker-compose

- 5g rfsim fdd_phytest
- 5g rfsimulator
- 5g fdd rfsim
- 5g f1 rfsim
- 5g l2sim
- 5g rfsim 24prb
- 5g rfsim 2x2
- 5g rfsim accelleran
- 5g rfsim e1
- 5g rfsim fr2 32prb
- 5g rfsim u0
- Update doc

We give NET_ADMIN (for interface bringup) and NET_RAW (for ping).
IPC_LOCK and SYS_NICE are intentionally left out to verify the
softmodems run without.

ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml

@@ -84,8 +84,9 @@ services:
 
     oai-cu:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-cu
+        cap_drop:
+            - ALL
         environment: 
             USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -104,8 +105,9 @@ services:
 
     oai-du:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-du
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim
                                     --log_config.global_log_options level,nocolor,time
@@ -128,8 +130,12 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     -r 106 --numerology 1 -C 3619200000
@@ -142,6 +148,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.181
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
             - ../../conf_files/rfsim_channel_ci.conf:/opt/oai-nr-ue/etc/rfsim_channel_ci.conf

ci-scripts/yaml_files/5g_fdd_rfsimulator/docker-compose.yaml

@@ -82,8 +82,9 @@ services:
             retries: 5
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa -E --rfsim --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -101,8 +102,12 @@ services:
             retries: 5
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment: 
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001100 --band 66 -C 2169090000 --CO -400000000 --ssb 378 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -110,6 +115,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:

ci-scripts/yaml_files/5g_l2sim_tdd/docker-compose.yaml

@@ -82,8 +82,9 @@ services:
             retries: 5
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: "l2sim-oai-gnb"
+        cap_drop:
+            - ALL
         network_mode: "host"
         environment:
             TZ: Europe/Paris
@@ -102,8 +103,9 @@ services:
 
     proxy:
         image: oai-lte-multi-ue-proxy:latest
-        privileged: true
         container_name: "l2sim-proxy"
+        cap_drop:
+            - ALL
         network_mode: "host"
         environment:
             TZ: Europe/Paris
@@ -118,14 +120,20 @@ services:
 
     oai-nr-ue0:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: "l2sim-oai-nr-ue0"
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         network_mode: "host"
         environment:
             TZ: Europe/Paris
             OPENAIR_DIR: /opt/oai-nr-ue
             USE_ADDITIONAL_OPTIONS: --nfapi STANDALONE_PNF --node-number 2 --sa --emulate-l1 --log_config.global_log_options level,time,thread_id,nocolor
             ASAN_OPTIONS: detect_leaks=0
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.band78.106prb.l2sim.conf:/opt/oai-nr-ue/etc/nr-ue.conf
             - ../../../openair1/SIMULATION/LTE_PHY/BLER_SIMULATIONS/AWGN/AWGN_results:/opt/oai-nr-ue/openair1/SIMULATION/LTE_PHY/BLER_SIMULATIONS/AWGN/AWGN_results

ci-scripts/yaml_files/5g_rfsimulator/README.md

@@ -237,12 +237,18 @@ Create the entry for the second UE in `docker-compose.yaml` file as follows:
 ```yaml
     oai-nr-ue2:
         image: oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue2
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
             - oai-gnb
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         networks:

ci-scripts/yaml_files/5g_rfsimulator/docker-compose.yaml

@@ -82,8 +82,9 @@ services:
             retries: 5
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa -E --rfsim --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -101,8 +102,12 @@ services:
             retries: 5
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001100 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -110,6 +115,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -119,8 +126,12 @@ services:
             retries: 5
     oai-nr-ue2:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue2
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001101 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -128,6 +139,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.151
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -137,8 +150,12 @@ services:
             retries: 5
     oai-nr-ue3:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue3
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001102 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -146,6 +163,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.152
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -155,8 +174,12 @@ services:
             retries: 5
     oai-nr-ue4:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue4
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001103 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -164,6 +187,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.153
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -173,8 +198,12 @@ services:
             retries: 5
     oai-nr-ue5:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue5
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001104 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -182,6 +211,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.154
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -191,8 +222,12 @@ services:
             retries: 5
     oai-nr-ue6:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue6
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001105 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -200,6 +235,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.155
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -209,8 +246,12 @@ services:
             retries: 5
     oai-nr-ue7:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue7
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001106 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -218,6 +259,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.156
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -227,8 +270,12 @@ services:
             retries: 5
     oai-nr-ue8:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue8
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001107 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -236,6 +283,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.157
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -245,8 +294,12 @@ services:
             retries: 5
     oai-nr-ue9:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue9
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001108 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -254,6 +307,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.158
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -263,8 +318,12 @@ services:
             retries: 5
     oai-nr-ue10:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue10
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001109 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -272,6 +331,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.159
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:

ci-scripts/yaml_files/5g_rfsimulator_24prb/docker-compose.yaml

@@ -82,8 +82,9 @@ services:
             retries: 5
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -101,8 +102,12 @@ services:
             retries: 5
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 24 --ssb 24 --numerology 1 -C 3604800000 --uicc0.imsi 208990100001100 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -110,6 +115,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:

ci-scripts/yaml_files/5g_rfsimulator_2x2/docker-compose.yaml

@@ -82,8 +82,9 @@ services:
             retries: 5
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -102,8 +103,12 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 106 --numerology 1 --band 78 -C 3319680000 --ue-nb-ant-tx 2 --uicc0.imsi 208990100001100 --ue-nb-ant-rx 2 --uecap_file /opt/oai-nr-ue/etc/uecap.xml --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -111,6 +116,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../../targets/PROJECTS/GENERIC-NR-5GC/CONF/uecap_ports2.xml:/opt/oai-nr-ue/etc/uecap.xml
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf

ci-scripts/yaml_files/5g_rfsimulator_accelleran/docker-compose.yaml

 services:
     oai-du:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-du
+        cap_drop:
+            - ALL
         network_mode: "host"
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --MACRLCs.[0].local_n_address 172.21.16.109 --MACRLCs.[0].remote_n_address 172.21.6.22 --log_config.global_log_options level,nocolor,time
@@ -15,13 +16,19 @@ services:
             retries: 5
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         network_mode: "host"
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 106 --numerology 1 -C 3619200000 --uicc0.imsi 208990100001140 --rfsimulator.serveraddr 127.0.0.1 --log_config.global_log_options level,nocolor,time
         depends_on:
             - oai-du
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:

ci-scripts/yaml_files/5g_rfsimulator_e1/docker-compose.yaml

@@ -66,8 +66,9 @@ services:
 
     oai-cucp:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-cucp
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                     --gNBs.[0].E1_INTERFACE.[0].ipv4_cucp 192.168.77.2
@@ -92,8 +93,9 @@ services:
 
     oai-cuup:
         image: oaisoftwarealliance/oai-nr-cuup:develop
-        privileged: true
         container_name: rfsim5g-oai-cuup
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                     --gNBs.[0].E1_INTERFACE.[0].ipv4_cucp 192.168.77.2
@@ -120,8 +122,9 @@ services:
 
     oai-cuup2:
         image: oaisoftwarealliance/oai-nr-cuup:develop
-        privileged: true
         container_name: rfsim5g-oai-cuup2
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                     --gNBs.[0].gNB_CU_UP_ID 0xe01
@@ -151,8 +154,9 @@ services:
 
     oai-cuup3:
         image: oaisoftwarealliance/oai-nr-cuup:develop
-        privileged: true
         container_name: rfsim5g-oai-cuup3
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                     --gNBs.[0].gNB_CU_UP_ID 0xe02
@@ -182,8 +186,9 @@ services:
 
     oai-du:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-du
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     --MACRLCs.[0].local_n_address 192.168.72.3
@@ -210,8 +215,9 @@ services:
 
     oai-du2:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-du2
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     --gNBs.[0].gNB_DU_ID 0xe01
@@ -241,8 +247,9 @@ services:
 
     oai-du3:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-du3
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     --gNBs.[0].gNB_DU_ID 0xe02
@@ -272,8 +279,12 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     -r 106 --numerology 1 -C 3619200000
@@ -284,6 +295,8 @@ services:
         networks:
             ue_net:
                 ipv4_address: 192.168.78.5
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -294,8 +307,12 @@ services:
 
     oai-nr-ue2:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue2
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     -r 106 --numerology 1 -C 3619200000
@@ -306,6 +323,8 @@ services:
         networks:
             ue_net:
                 ipv4_address: 192.168.78.6
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:
@@ -316,8 +335,12 @@ services:
 
     oai-nr-ue3:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue3
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                     -r 106 --numerology 1 -C 3619200000
@@ -329,6 +352,8 @@ services:
         networks:
             ue_net:
                 ipv4_address: 192.168.78.7
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck:

ci-scripts/yaml_files/5g_rfsimulator_fdd_phytest/docker-compose.yaml

 services:
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --phy-test --rfsim --rfsimulator.wait_timeout 20 --noS1 --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
         networks:
             public_net:
                 ipv4_address: 192.168.71.140
+        devices:
+            - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/gnb.band66.106prb.rfsim.phytest-dora.conf:/opt/oai-gnb/etc/gnb.conf
             - rrc.config:/opt/oai-gnb/
@@ -20,11 +26,17 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --phy-test --rfsim --noS1 --reconfig-file etc/rrc/reconfig.raw --rbconfig-file etc/rrc/rbconfig.raw --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
+        devices:
+            - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
             - rrc.config:/opt/oai-nr-ue/etc/rrc/

ci-scripts/yaml_files/5g_rfsimulator_fr2_32prb/docker-compose.yaml

@@ -83,8 +83,9 @@ services:
 
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -101,13 +102,19 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim
                                     --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
                                     -r 32 --numerology 3 --band 261 -C 27533160000 --ssb 73
             ASAN_OPTIONS: detect_leaks=0
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         depends_on:

ci-scripts/yaml_files/5g_rfsimulator_tdd_dora/docker-compose.yaml

 services:
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --do-ra --rfsim --rfsimulator.wait_timeout 20 --noS1 --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
         networks:
             public_net:
                 ipv4_address: 192.168.71.140
+        devices:
+            - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/gnb.band78.106prb.rfsim.phytest-dora.conf:/opt/oai-gnb/etc/gnb.conf
             - rrc.config:/opt/oai-gnb/
@@ -20,11 +26,17 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --do-ra --rfsim --noS1 --reconfig-file etc/rrc/reconfig.raw --rbconfig-file etc/rrc/rbconfig.raw --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
+        devices:
+            - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
             - rrc.config:/opt/oai-nr-ue/etc/rrc/

ci-scripts/yaml_files/5g_rfsimulator_u0_25prb/docker-compose.yaml

@@ -82,8 +82,9 @@ services:
             retries: 5
     oai-gnb:
         image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
         container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
             ASAN_OPTIONS: detect_leaks=0
@@ -102,8 +103,12 @@ services:
 
     oai-nr-ue:
         image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
         container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
         environment:
             USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 25 --numerology 0 --uicc0.imsi 208990100001100 --band 66 -C 2152680000 --CO -400000000 --ssb 48 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
         depends_on:
@@ -111,6 +116,8 @@ services:
         networks:
             public_net:
                 ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
         volumes:
             - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
         healthcheck: