Adding privileged containers to Docker Swarm mode

tree ./cli/command -L 1
./cli/command
|-- bundlefile
|-- checkpoint
|-- image
|-- inspect
...
|-- network
|-- node
...
|-- service     # <<<<
|-- stack
...
`-- volume

diff --git a/cli/command/service/opts.go b/cli/command/service/opts.go
index 6d427451..b61b6c0f 100644
--- a/cli/command/service/opts.go
+++ b/cli/command/service/opts.go
@@ -483,6 +483,7 @@ type serviceOptions struct {
        stopSignal      string
+       privileged      bool
        mounts          opts.MountOpt
        dns             opts.ListOpts
        dnsSearch       opts.ListOpts
@@ -622,6 +623,7 @@ func (options *serviceOptions) ToService(ctx context.Context, apiClient client.N
                                Groups:     options.groups.GetAll(),
                                StopSignal: options.stopSignal,
                                TTY:        options.tty,
+                               Privileged: options.privileged,
                                ReadOnly:   options.readOnly,
                                Mounts:     options.mounts.Value(),
                                DNSConfig: &swarm.DNSConfig{
@@ -795,6 +797,8 @@ func addServiceFlags(flags *pflag.FlagSet, opts *serviceOptions, defaultFlagValu
+       flags.BoolVar(&opts.privileged, flagPrivileged, false, "Give extended privileges to the service")
+       flags.SetAnnotation(flagPrivileged, "version", []string{"1.35"})
        flags.BoolVarP(&opts.tty, flagTTY, "t", false, "Allocate a pseudo-TTY")

@@ -878,6 +882,7 @@ const (
+       flagPrivileged              = "privileged"
        flagUpdateDelay             = "update-delay"

# Grab the release zip
curl \
        -SL \
        -o protoc.zip \
        https://github.com/google/protobuf/releases/download/v3.5.1/protoc-3.5.1-linux-x86_64.zip

# Unzip it
unzip ./protoc.zip

# Move the correpsonding files
sudo mv ./bin/protoc /usr/local/bin
sudo mv ./include/google /usr/local/include/google

--- a/agent/exec/dockerapi/container.go
+++ b/agent/exec/dockerapi/container.go
@@ -209,6 +209,7 @@ func (c *containerConfig) hostConfig() *enginecontainer.HostConfig {
                PortBindings: c.portBindings(),
                Init:         c.init(),
                Isolation:    c.isolation(),
+               Privileged:   c.spec().Privileged,
        }
 
        // The format of extra hosts on swarmkit is specified in:


diff --git a/cmd/swarmctl/service/flagparser/container.go b/cmd/swarmctl/service/flagparser/container.go
index 1507a168..37f11dd1 100644
--- a/cmd/swarmctl/service/flagparser/container.go
+++ b/cmd/swarmctl/service/flagparser/container.go
@@ -15,6 +15,15 @@ func parseContainer(flags *pflag.FlagSet, spec *api.ServiceSpec) error {
                spec.Task.GetContainer().Image = image
        }
 
+       if flags.Changed("privileged") {
+               privileged, err := flags.GetBool("privileged")
+               if err != nil {
+                       return err
+               }
+
+               spec.Task.GetContainer().Privileged = privileged
+       }
+
        if flags.Changed("hostname") {
                hostname, err := flags.GetString("hostname")
                if err != nil {

diff --git a/api/specs.proto b/api/specs.proto
index 14448d04..a5945ec3 100644
--- a/api/specs.proto
+++ b/api/specs.proto
@@ -318,6 +318,9 @@ message ContainerSpec {
        // PidsLimit prevents from OS resource damage by applications inside the container 
        // using fork bomb attack.
        int64 pidsLimit = 25;
+
+       // Privileged gives extended privileges to the container
+       bool privileged = 26;
 }

# Install extra dependencies that might be needed.
make setup

# Generate the protobuf golang files.
make generate

# Build the swarkit binaries
make binaries

# Get the current commit 
swarmkit $ FORKED_SWARMKIT_COMMIT=$(git rev-parse HEAD)
5598a39a89bd7482864c6279ae5544d9e8aa5299

# Go to our forked moby/moby repository
swarmkit $ cd ../docker

# Set a variable that defines the repository for `vndr`
# to use to gather our forked source code.
FORKED_SWARMKIT_REPO=https://github.com/cirocosta/swarmkit

# Prepare the variables to be used in the SED replacement
SED_FROM="\(github.com/docker/swarmkit\) \([a-zA-Z0-9]*\)"
SED_TO="\1 $FORKED_SWARMKIT_COMMIT $FORKED_SWARMKIT_REPO"

# Perform the replacement in `vendor.conf`.
# ps.: you could just grab an editor of your choice
# (like vim) and do the changes there.
#
# Here I'm using `sed` just to make the changes
# reproducible by copying and pasting.
docker $ sed \
  --in-place \
  "s#$SED_FROM#$SED_TO#g" \
  ./vendor.conf

# Update the dependencies
vndr

# Run the `binary` target specified in ./Makefile
make binary

diff --git a/api/types/swarm/container.go b/api/types/swarm/container.go
index 0041653c9..c16c55fd8 100644
--- a/api/types/swarm/container.go
+++ b/api/types/swarm/container.go
@@ -57,6 +57,7 @@ type ContainerSpec struct {
        Privileges      *Privileges             `json:",omitempty"`
        StopSignal      string                  `json:",omitempty"`
        TTY             bool                    `json:",omitempty"`
+       Privileged      bool                    `json:",omitempty"`
        OpenStdin       bool                    `json:",omitempty"`
        ReadOnly        bool                    `json:",omitempty"`
        Mounts          []mount.Mount           `json:",omitempty"`
diff --git a/daemon/cluster/convert/container.go b/daemon/cluster/convert/container.go
index 0a34fc73e..9eb1feb4e 100644
--- a/daemon/cluster/convert/container.go
+++ b/daemon/cluster/convert/container.go
@@ -17,6 +17,7 @@ func containerSpecFromGRPC(c *swarmapi.ContainerSpec) *types.ContainerSpec {
        if c == nil {
                return nil
        }
+
        containerSpec := &types.ContainerSpec{
                Image:      c.Image,
                Labels:     c.Labels,
@@ -32,6 +33,7 @@ func containerSpecFromGRPC(c *swarmapi.ContainerSpec) *types.ContainerSpec {
                OpenStdin:  c.OpenStdin,
                ReadOnly:   c.ReadOnly,
                Hosts:      c.Hosts,
+    Privileged: c.Privileged,
                Secrets:    secretReferencesFromGRPC(c.Secrets),
                Configs:    configReferencesFromGRPC(c.Configs),
                Isolation:  IsolationFromGRPC(c.Isolation),
@@ -228,6 +230,7 @@ func containerToGRPC(c *types.ContainerSpec) (*swarmapi.ContainerSpec, error) {
                Groups:     c.Groups,
                StopSignal: c.StopSignal,
                TTY:        c.TTY,
+    Privileged: c.Privileged,
                OpenStdin:  c.OpenStdin,
                ReadOnly:   c.ReadOnly,
                Hosts:      c.Hosts,
diff --git a/daemon/cluster/executor/container/container.go b/daemon/cluster/executor/container/container.go
index 69d673bd3..829c5dcc3 100644
--- a/daemon/cluster/executor/container/container.go
+++ b/daemon/cluster/executor/container/container.go
@@ -351,6 +351,7 @@ func (c *containerConfig) hostConfig() *enginecontainer.HostConfig {
        hc := &enginecontainer.HostConfig{
                Resources:      c.resources(),
                GroupAdd:       c.spec().Groups,
+               Privileged:     c.spec().Privileged,
                PortBindings:   c.portBindings(),
                Mounts:         c.mounts(),
                ReadonlyRootfs: c.spec().ReadOnly,