<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Norman,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We do the same.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
But we use "-t" instead on "-T" for the validation.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In order to allow kea to run in the gitlab CI/CD, we have added this:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
- setcap cap_net_bind_service,cap_net_raw+i /usr/sbin/kea-dhcp4 </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hope it helps.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Veronique<br>
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Kea-users <kea-users-bounces@lists.isc.org> on behalf of Elton, Norman N <wnelto@wm.edu><br>
<b>Sent:</b> Wednesday, January 29, 2025 10:15 PM<br>
<b>To:</b> kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject:</b> [Kea-users] Unable to test configuration in docker - Kea always opening a raw socket?</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Aptos}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif}
span.x_EmailStyle17
{font-family:"Aptos",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:11.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="color:#212121">We’re storing Kea configurations in GitLab, and would like to use CI/CD to validate them before pushing out to our servers. I can run “kea-dhcp4 -T <file>” in a docker container on my desktop fine, but get
an “Operation Not Permitted” error when doing the same through GitLab. It appears that GitLab CI/CD runners have additional restrictions in place, including dropping the NET_RAW capability. I can reproduce the error by running docker with “--cap-drop NET_RAW”.</span></p>
<p class="x_MsoNormal"><span style="color:#212121"> </span></p>
<p class="x_MsoNormal"><span style="color:#212121">This all makes sense, CI/CD tasks shouldn’t be opening raw sockets. Except that we get the same error even after configuring "dhcp-socket-type": "udp". I even removed all the interfaces from the configuration
("interfaces": []) as an extra step.</span></p>
<p class="x_MsoNormal"><span style="color:#212121"> </span></p>
<p class="x_MsoNormal"><span style="color:#212121">It seems that kea is trying to open a raw socket no matter what. Any reason why? Any other tricks to prevent this error when testing the configuration?</span></p>
<p class="x_MsoNormal"><span style="color:#212121"> </span></p>
<p class="x_MsoNormal"><span style="color:#212121">Thanks!</span></p>
<p class="x_MsoNormal"><span style="color:#212121"> </span></p>
<p class="x_MsoNormal"><span style="color:#212121">Norman</span></p>
<p class="x_MsoNormal"><span style="color:#212121"> </span></p>
<p class="x_MsoNormal"> </p>
</div>
</div>
</body>
</html>