Run docker in privileged mode

[LasseBlaauwbroek]

Without the --privileged flag, docker will run with reduced privileges. My workflow needs more privileges (in particular I need the capset operation). This PR adds that flag, as I see no security issue with this. Note that with this change, you should be able to remove the --disable-sandboxing flag here:

https://github.com/coq-community/docker-base/blob/b47cc67d1f78217ba4a0ade773ab61d19e5c817d/base/single/Dockerfile#L81

[erikmd]

Hi @LasseBlaauwbroek (sorry for late reply)

Without the --privileged flag, docker will run with reduced privileges. My workflow needs more privileges (in particular I need the capset operation).

OK. BTW could you give a bit more details on your use case / on the exact CAPs you need? (cf. man 7 capabilities)

This PR adds that flag, as I see no security issue with this.

the --privileged flag basically drops the container isolation by adding all capabilities, so maybe a less invasive change would be to just rely on some --cap-add flag?

Note that with this change, you should be able to remove the --disable-sandboxing flag here:

https://github.com/coq-community/docker-base/blob/b47cc67d1f78217ba4a0ade773ab61d19e5c817d/base/single/Dockerfile#L81

Yes and no. You're right that it is related! however beyond CI, the docker-coq images are also intended to be run locally (without any --privileged-like flag), so I'm unsure we can benefit there from the change suggested in your PR #50.