From 4a62821e07617a22e86f49c1d50bdaffc915a135 Mon Sep 17 00:00:00 2001
From: Sebastien Boeuf <sebastien.boeuf@intel.com>
Date: Mon, 17 Feb 2020 16:26:10 +0100
Subject: [PATCH] ci: Don't run unit tests in a privileged container

The unit tests require some specific Linux capabilities and also to have
access to /dev/kvm device. This commit makes sure we enable only what's
necessary instead of blindly enable full priviliges with --privileged
option.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
(cherry picked from commit 7fabca35487d2218a5b42eaf6d225ff95a0a6840)
---
 scripts/dev_cli.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/dev_cli.sh b/scripts/dev_cli.sh
index a8be7d1d9..78b28e561 100755
--- a/scripts/dev_cli.sh
+++ b/scripts/dev_cli.sh
@@ -223,8 +223,9 @@ cmd_tests() {
 	       -ti \
 	       --workdir "$CTR_CLH_ROOT_DIR" \
 	       --rm \
-	       --privileged \
-	       --volume /dev:/dev \
+	       --device /dev/kvm \
+	       --device /dev/net/tun \
+	       --cap-add net_admin \
 	       --volume "$CLH_ROOT_DIR:$CTR_CLH_ROOT_DIR" \
 	       "$CTR_IMAGE" \
 	       ./scripts/run_unit_tests.sh "$@"