Drop as much capabilities as possibile for the Collabora container (#8000)

php/containers.json

@@ -418,7 +418,7 @@
         "CHOWN"
       ],
       "cap_drop": [
-        "NET_RAW"
+        "ALL"
       ]
     },
     {

php/src/Container/Container.php

@@ -27,6 +27,8 @@ readonly class Container {
         public bool                          $enableNvidiaGpu,
         /** @var string[] */
         public array                         $capAdd,
+        /** @var string[] */
+        public array                         $capDrop,
         public int                           $shmSize,
         public bool                          $apparmorUnconfined,
         /** @var string[] */

php/src/ContainerDefinitionFetcher.php

@@ -308,6 +308,11 @@ readonly class ContainerDefinitionFetcher {
                 $capAdd = $entry['cap_add'];
             }
 
+            $capDrop = [];
+            if (isset($entry['cap_drop'])) {
+                $capDrop = $entry['cap_drop'];
+            }
+
             $shmSize = -1;
             if (isset($entry['shm_size'])) {
                 $shmSize = $entry['shm_size'];
@@ -370,6 +375,7 @@ readonly class ContainerDefinitionFetcher {
                 $devices,
                 $enableNvidiaGpu,
                 $capAdd,
+                $capDrop,
                 $shmSize,
                 $apparmorUnconfined,
                 $backupVolumes,

php/src/Docker/DockerActionManager.php

@@ -401,8 +401,11 @@ readonly class DockerActionManager {
             $requestBody['HostConfig']['CapAdd'] = $capAdds;
         }
 
-        // Disable arp spoofing
-        if (!in_array('NET_RAW', $capAdds, true)) {
+        $capDrops = $container->capDrop;
+        if (count($capDrops) > 0) {
+            $requestBody['HostConfig']['CapDrop'] = $capDrops;
+        } else if (!in_array('NET_RAW', $capAdds, true)) {
+            // Prevent ARP spoofing by default
             $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
         }
 
@@ -463,9 +466,11 @@ readonly class DockerActionManager {
         // Special things for the collabora container which should not be exposed in the containers.json
         } elseif ($container->identifier === 'nextcloud-aio-collabora') {
             if (!$this->configurationManager->collaboraSeccompDisabled) {
-                // Load reference seccomp profile for collabora
+                // Load reference seccomp profile for collabora...
                 $seccompProfile = (string)file_get_contents(DataConst::GetCollaboraSeccompProfilePath());
                 $requestBody['HostConfig']['SecurityOpt'] = ["label:disable", "seccomp=$seccompProfile"];
+                // ...which allows the collabora container to run without any capabilities
+                $requestBody['HostConfig']['CapAdd'] = [];
             }
 
             // Additional Collabora options