Use capabilities in B200-based docker-compose

- sa_b200_gnb
- sa_aw2s_gnb
- sa_e1_b200
- sa_f1_b200
- sa_sc_b200_gnb
- nsa_b200_gnb

By default, the container has no access to /dev. Mount all USB devices
into the container to ease usability: by default, USB devices are
mounted under /dev/bus/usb using the bus ID, which is different on every
system and might change on reboots or with (un-)plugging USB devices.
Hence, mount all USB; the process has not many capabilities anyway, and
thus might not do much harm.

A proper solution would be to write a udev rule to mount a device using
its vendor and product ID, and only mount the corresponding device into
the container.

ci-scripts/yaml_files/nsa_b200_gnb/docker-compose.yml

 services:
     gnb_mono_tdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: nsa-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
             USE_B2XX: 'yes'
             USE_ADDITIONAL_OPTIONS: -E -q --RUs.[0].sdr_addrs serial=30C51D4 --continuous-tx --log_config.global_log_options level,nocolor,time,line_num,function
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb.nsa.band78.106prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         networks:
             public_net:
                 ipv4_address: 192.168.68.194

ci-scripts/yaml_files/sa_b200_gnb/docker-compose.yml

 services:
     gnb_mono_tdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
             USE_B2XX: 'yes'
             USE_ADDITIONAL_OPTIONS: --sa --RUs.[0].sdr_addrs serial=30C51D4 --telnetsrv --telnetsrv.shrmod ci --continuous-tx --log_config.global_log_options level,nocolor,time,line_num,function
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb.sa.band78.51prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         # for performance reasons, we use host mode: in bridge mode, we have
         # unacceptable DL TCP performance. However, the whole point of
         # containerization is to not be in host mode, so update this to macvlan

ci-scripts/yaml_files/sa_e1_b200_gnb/docker-compose.yml

 services:
     gnb_cucp:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-cucp-gnb
+        cap_drop:
+            - ALL
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -25,8 +26,12 @@ services:
 
     gnb_cuup:
         image: oai-nr-cuup:latest
-        privileged: true
         container_name: sa-cuup-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -48,8 +53,12 @@ services:
 
     gnb_du_tdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-du-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -61,9 +70,10 @@ services:
                                     --gNBs.[0].min_rxtxtime 2 --gNBs.[0].do_CSIRS 1 --gNBs.[0].do_SRS 1
                                     --RUs.[0].att_rx 14 --RUs.[0].att_tx 14
                                     --log_config.global_log_options level,nocolor,time,line_num,function
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb-du.sa.band78.106prb.usrpb200.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         # for performance reasons, we use host mode: in bridge mode, we have
         # unacceptable DL TCP performance. However, the whole point of
         # containerization is to not be in host mode, so update this to macvlan

ci-scripts/yaml_files/sa_f1_b200_gnb/docker-compose.yml

 services:
     gnb_cu:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-cu-gnb
+        cap_drop:
+            - ALL
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -26,8 +27,12 @@ services:
 
     gnb_du_fdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-du-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
@@ -36,9 +41,10 @@ services:
                                     --telnetsrv --telnetsrv.listenport 9091 --telnetsrv.shrmod ci
                                     --gNBs.[0].min_rxtxtime 2 --gNBs.[0].do_CSIRS 1 --gNBs.[0].do_SRS 0 --L1s.[0].max_ldpc_iterations 20
                                     --log_config.global_log_options level,nocolor,time,line_num,function
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb-du.sa.band1.52prb.usrpb210.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         # for performance reasons, we use host mode: in bridge mode, we have
         # unacceptable DL TCP performance. However, the whole point of
         # containerization is to not be in host mode, so update this to macvlan

ci-scripts/yaml_files/sa_sc_b200_gnb/docker-compose.yml

 services:
     gnb_mono_tdd:
         image: oai-gnb:latest
-        privileged: true
         container_name: sa-b200-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - SYS_NICE
+            - IPC_LOCK
         ulimits:
           core: -1 # for core dumps
         environment:
             USE_B2XX: 'yes'
             USE_ADDITIONAL_OPTIONS: --sa --RUs.[0].sdr_addrs serial=30C51D4 --telnetsrv --telnetsrv.shrmod ci --continuous-tx --log_config.global_log_options level,nocolor,time,line_num,function -E
+        devices:
+            - /dev/bus/usb/:/dev/bus/usb/
         volumes:
             - ../../conf_files/gnb.sa.band78.106prb.usrpb200.sc-fdma.conf:/opt/oai-gnb/etc/gnb.conf
-            - /dev:/dev
         # for performance reasons, we use host mode: in bridge mode, we have
         # unacceptable DL TCP performance. However, the whole point of
         # containerization is to not be in host mode, so update this to macvlan