Revert "Drop as much capabilities as possibile for the Collabora container (#8000)"

This reverts commit 9dcb25b4ae, reversing
changes made to 261675f4d3.

php/containers.json

@@ -418,7 +418,7 @@
         "CHOWN"
       ],
       "cap_drop": [
-        "ALL"
+        "NET_RAW"
       ]
     },
     {

php/src/Container/Container.php

@@ -27,8 +27,6 @@ readonly class Container {
         public bool                          $enableNvidiaGpu,
         /** @var string[] */
         public array                         $capAdd,
-        /** @var string[] */
-        public array                         $capDrop,
         public int                           $shmSize,
         public bool                          $apparmorUnconfined,
         /** @var string[] */

php/src/ContainerDefinitionFetcher.php

@@ -308,11 +308,6 @@ readonly class ContainerDefinitionFetcher {
                 $capAdd = $entry['cap_add'];
             }
 
-            $capDrop = [];
-            if (isset($entry['cap_drop'])) {
-                $capDrop = $entry['cap_drop'];
-            }
-
             $shmSize = -1;
             if (isset($entry['shm_size'])) {
                 $shmSize = $entry['shm_size'];
@@ -375,7 +370,6 @@ readonly class ContainerDefinitionFetcher {
                 $devices,
                 $enableNvidiaGpu,
                 $capAdd,
-                $capDrop,
                 $shmSize,
                 $apparmorUnconfined,
                 $backupVolumes,

php/src/Docker/DockerActionManager.php

@@ -401,11 +401,8 @@ readonly class DockerActionManager {
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
-        $capDrops = $container->capDrop;
-        if (count($capDrops) > 0) {
-            $requestBody['HostConfig']['CapDrop'] = $capDrops;
-        } else if (!in_array('NET_RAW', $capAdds, true)) {
-            // Prevent ARP spoofing by default
+        // Disable arp spoofing
+        if (!in_array('NET_RAW', $capAdds, true)) {
             $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
         }
 
@@ -466,11 +463,9 @@ readonly class DockerActionManager {
         // Special things for the collabora container which should not be exposed in the containers.json
         } elseif ($container->identifier === 'nextcloud-aio-collabora') {
             if (!$this->configurationManager->collaboraSeccompDisabled) {
-                // Load reference seccomp profile for collabora...
+                // Load reference seccomp profile for collabora
                 $seccompProfile = (string)file_get_contents(DataConst::GetCollaboraSeccompProfilePath());
                 $requestBody['HostConfig']['SecurityOpt'] = ["label:disable", "seccomp=$seccompProfile"];
-                // ...which allows the collabora container to run without any capabilities
-                $requestBody['HostConfig']['CapAdd'] = [];
             }
 
             // Additional Collabora options