Handle cap_drop from container definitions

Signed-off-by: Fs00 <francescosaltori@gmail.com>

php/src/Container/Container.php

@@ -27,6 +27,8 @@ readonly class Container {
         public bool                          $enableNvidiaGpu,
         /** @var string[] */
         public array                         $capAdd,
+        /** @var string[] */
+        public array                         $capDrop,
         public int                           $shmSize,
         public bool                          $apparmorUnconfined,
         /** @var string[] */

php/src/ContainerDefinitionFetcher.php

@@ -298,6 +298,11 @@ readonly class ContainerDefinitionFetcher {
                 $capAdd = $entry['cap_add'];
             }
 
+            $capDrop = [];
+            if (isset($entry['cap_drop'])) {
+                $capDrop = $entry['cap_drop'];
+            }
+
             $shmSize = -1;
             if (isset($entry['shm_size'])) {
                 $shmSize = $entry['shm_size'];
@@ -360,6 +365,7 @@ readonly class ContainerDefinitionFetcher {
                 $devices,
                 $enableNvidiaGpu,
                 $capAdd,
+                $capDrop,
                 $shmSize,
                 $apparmorUnconfined,
                 $backupVolumes,

php/src/Docker/DockerActionManager.php

@@ -378,9 +378,9 @@ readonly class DockerActionManager {
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
-        // Disable arp spoofing
-        if (!in_array('NET_RAW', $capAdds, true)) {
-            $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
+        $capDrops = $container->capDrop;
+        if (count($capDrops) > 0) {
+            $requestBody['HostConfig']['CapDrop'] = $capDrops;
         }
 
         // Disable SELinux for AIO containers so that it does not break them