Merge pull request #3377 from nextcloud/enh/noid/drop-net-raw

nextcloud · Sep 27, 2023 · 8e4678f · 8e4678f
2 parents 3e25acc + bcced0b
commit 8e4678f
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php
@@ -476,6 +476,9 @@ public function CreateContainer(Container $container) : void {
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
+        // Disable arp spoofing
+        $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
+
         if ($container->isApparmorUnconfined()) {
             $requestBody['HostConfig']['SecurityOpt'] = ["apparmor:unconfined"];
         }