Use capabilities in 5G RFsim docker-compose

- 5g rfsim fdd_phytest - 5g rfsimulator - 5g fdd rfsim - 5g f1 rfsim - 5g l2sim - 5g rfsim 24prb - 5g rfsim 2x2 - 5g rfsim accelleran - 5g rfsim e1 - 5g rfsim fr2 32prb - 5g rfsim u0 - Update doc We give NET_ADMIN (for interface bringup) and NET_RAW (for ping). IPC_LOCK and SYS_NICE are intentionally left out to verify the softmodems run without.

Use capabilities in 5G RFsim docker-compose
- 5g rfsim fdd_phytest - 5g rfsimulator - 5g fdd rfsim - 5g f1 rfsim - 5g l2sim - 5g rfsim 24prb - 5g rfsim 2x2 - 5g rfsim accelleran - 5g rfsim e1 - 5g rfsim fr2 32prb - 5g rfsim u0 - Update doc We give NET_ADMIN (for interface bringup) and NET_RAW (for ping). IPC_LOCK and SYS_NICE are intentionally left out to verify the softmodems run without.
9f8fad86 · Robert Schmidt · 9b3ab10c · 9f8fad86 · 9f8fad86 · 9f8fad86
Commit 9f8fad86 authored Apr 18, 2024 by Robert Schmidt
13 changed files
--- a/ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_f1_rfsimulator/docker-compose.yaml
@@ -84,8 +84,9 @@ services:

    oai-cu:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-cu
+        cap_drop:
+            - ALL
        environment: 
            USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -104,8 +105,9 @@ services:

    oai-du:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-du
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim
                                    --log_config.global_log_options level,nocolor,time
@@ -128,8 +130,12 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    -r 106 --numerology 1 -C 3619200000
@@ -142,6 +148,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.181
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
            - ../../conf_files/rfsim_channel_ci.conf:/opt/oai-nr-ue/etc/rfsim_channel_ci.conf

--- a/ci-scripts/yaml_files/5g_fdd_rfsimulator/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_fdd_rfsimulator/docker-compose.yaml
@@ -82,8 +82,9 @@ services:
            retries: 5
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa -E --rfsim --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -101,8 +102,12 @@ services:
            retries: 5
    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment: 
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001100 --band 66 -C 2169090000 --CO -400000000 --ssb 378 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -110,6 +115,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:

--- a/ci-scripts/yaml_files/5g_l2sim_tdd/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_l2sim_tdd/docker-compose.yaml
@@ -82,8 +82,9 @@ services:
            retries: 5
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: "l2sim-oai-gnb"
+        cap_drop:
+            - ALL
        network_mode: "host"
        environment:
            TZ: Europe/Paris
@@ -102,8 +103,9 @@ services:

    proxy:
        image: oai-lte-multi-ue-proxy:latest
-        privileged: true
        container_name: "l2sim-proxy"
+        cap_drop:
+            - ALL
        network_mode: "host"
        environment:
            TZ: Europe/Paris
@@ -118,14 +120,20 @@ services:

    oai-nr-ue0:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: "l2sim-oai-nr-ue0"
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        network_mode: "host"
        environment:
            TZ: Europe/Paris
            OPENAIR_DIR: /opt/oai-nr-ue
            USE_ADDITIONAL_OPTIONS: --nfapi STANDALONE_PNF --node-number 2 --sa --emulate-l1 --log_config.global_log_options level,time,thread_id,nocolor
            ASAN_OPTIONS: detect_leaks=0
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.band78.106prb.l2sim.conf:/opt/oai-nr-ue/etc/nr-ue.conf
            - ../../../openair1/SIMULATION/LTE_PHY/BLER_SIMULATIONS/AWGN/AWGN_results:/opt/oai-nr-ue/openair1/SIMULATION/LTE_PHY/BLER_SIMULATIONS/AWGN/AWGN_results

--- a/ci-scripts/yaml_files/5g_rfsimulator/README.md
+++ b/ci-scripts/yaml_files/5g_rfsimulator/README.md
@@ -237,12 +237,18 @@ Create the entry for the second UE in `docker-compose.yaml` file as follows:
 ```yaml
    oai-nr-ue2:
        image: oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue2
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
            - oai-gnb
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        networks:

--- a/ci-scripts/yaml_files/5g_rfsimulator/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator/docker-compose.yaml
@@ -82,8 +82,9 @@ services:
            retries: 5
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa -E --rfsim --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -101,8 +102,12 @@ services:
            retries: 5
    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001100 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -110,6 +115,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -119,8 +126,12 @@ services:
            retries: 5
    oai-nr-ue2:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue2
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001101 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -128,6 +139,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.151
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -137,8 +150,12 @@ services:
            retries: 5
    oai-nr-ue3:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue3
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001102 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -146,6 +163,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.152
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -155,8 +174,12 @@ services:
            retries: 5
    oai-nr-ue4:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue4
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001103 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -164,6 +187,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.153
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -173,8 +198,12 @@ services:
            retries: 5
    oai-nr-ue5:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue5
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001104 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -182,6 +211,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.154
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -191,8 +222,12 @@ services:
            retries: 5
    oai-nr-ue6:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue6
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001105 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -200,6 +235,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.155
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -209,8 +246,12 @@ services:
            retries: 5
    oai-nr-ue7:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue7
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001106 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -218,6 +259,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.156
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -227,8 +270,12 @@ services:
            retries: 5
    oai-nr-ue8:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue8
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001107 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -236,6 +283,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.157
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -245,8 +294,12 @@ services:
            retries: 5
    oai-nr-ue9:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue9
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001108 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -254,6 +307,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.158
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -263,8 +318,12 @@ services:
            retries: 5
    oai-nr-ue10:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue10
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: -E --sa --rfsim -r 106 --numerology 1 --uicc0.imsi 208990100001109 -C 3619200000 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -272,6 +331,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.159
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:

--- a/ci-scripts/yaml_files/5g_rfsimulator_24prb/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_24prb/docker-compose.yaml
@@ -82,8 +82,9 @@ services:
            retries: 5
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -101,8 +102,12 @@ services:
            retries: 5
    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 24 --ssb 24 --numerology 1 -C 3604800000 --uicc0.imsi 208990100001100 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -110,6 +115,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:

--- a/ci-scripts/yaml_files/5g_rfsimulator_2x2/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_2x2/docker-compose.yaml
@@ -82,8 +82,9 @@ services:
            retries: 5
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -102,8 +103,12 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 106 --numerology 1 --band 78 -C 3319680000 --ue-nb-ant-tx 2 --uicc0.imsi 208990100001100 --ue-nb-ant-rx 2 --uecap_file /opt/oai-nr-ue/etc/uecap.xml --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -111,6 +116,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../../targets/PROJECTS/GENERIC-NR-5GC/CONF/uecap_ports2.xml:/opt/oai-nr-ue/etc/uecap.xml
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf

--- a/ci-scripts/yaml_files/5g_rfsimulator_accelleran/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_accelleran/docker-compose.yaml
 services:
    oai-du:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-du
+        cap_drop:
+            - ALL
        network_mode: "host"
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --MACRLCs.[0].local_n_address 172.21.16.109 --MACRLCs.[0].remote_n_address 172.21.6.22 --log_config.global_log_options level,nocolor,time
@@ -15,13 +16,19 @@ services:
            retries: 5
    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        network_mode: "host"
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 106 --numerology 1 -C 3619200000 --uicc0.imsi 208990100001140 --rfsimulator.serveraddr 127.0.0.1 --log_config.global_log_options level,nocolor,time
        depends_on:
            - oai-du
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:

--- a/ci-scripts/yaml_files/5g_rfsimulator_e1/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_e1/docker-compose.yaml
@@ -66,8 +66,9 @@ services:

    oai-cucp:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-cucp
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                    --gNBs.[0].E1_INTERFACE.[0].ipv4_cucp 192.168.77.2
@@ -92,8 +93,9 @@ services:

    oai-cuup:
        image: oaisoftwarealliance/oai-nr-cuup:develop
-        privileged: true
        container_name: rfsim5g-oai-cuup
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                    --gNBs.[0].E1_INTERFACE.[0].ipv4_cucp 192.168.77.2
@@ -120,8 +122,9 @@ services:

    oai-cuup2:
        image: oaisoftwarealliance/oai-nr-cuup:develop
-        privileged: true
        container_name: rfsim5g-oai-cuup2
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                    --gNBs.[0].gNB_CU_UP_ID 0xe01
@@ -151,8 +154,9 @@ services:

    oai-cuup3:
        image: oaisoftwarealliance/oai-nr-cuup:develop
-        privileged: true
        container_name: rfsim5g-oai-cuup3
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --log_config.global_log_options level,nocolor,time
                                    --gNBs.[0].gNB_CU_UP_ID 0xe02
@@ -182,8 +186,9 @@ services:

    oai-du:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-du
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    --MACRLCs.[0].local_n_address 192.168.72.3
@@ -210,8 +215,9 @@ services:

    oai-du2:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-du2
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    --gNBs.[0].gNB_DU_ID 0xe01
@@ -241,8 +247,9 @@ services:

    oai-du3:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-du3
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    --gNBs.[0].gNB_DU_ID 0xe02
@@ -272,8 +279,12 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    -r 106 --numerology 1 -C 3619200000
@@ -284,6 +295,8 @@ services:
        networks:
            ue_net:
                ipv4_address: 192.168.78.5
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -294,8 +307,12 @@ services:

    oai-nr-ue2:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue2
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    -r 106 --numerology 1 -C 3619200000
@@ -306,6 +323,8 @@ services:
        networks:
            ue_net:
                ipv4_address: 192.168.78.6
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:
@@ -316,8 +335,12 @@ services:

    oai-nr-ue3:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue3
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
                                    -r 106 --numerology 1 -C 3619200000
@@ -329,6 +352,8 @@ services:
        networks:
            ue_net:
                ipv4_address: 192.168.78.7
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck:

--- a/ci-scripts/yaml_files/5g_rfsimulator_fdd_phytest/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_fdd_phytest/docker-compose.yaml
 services:
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --phy-test --rfsim --rfsimulator.wait_timeout 20 --noS1 --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
        networks:
            public_net:
                ipv4_address: 192.168.71.140
+        devices:
+            - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/gnb.band66.106prb.rfsim.phytest-dora.conf:/opt/oai-gnb/etc/gnb.conf
            - rrc.config:/opt/oai-gnb/
@@ -20,11 +26,17 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --phy-test --rfsim --noS1 --reconfig-file etc/rrc/reconfig.raw --rbconfig-file etc/rrc/rbconfig.raw --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
+        devices:
+            - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
            - rrc.config:/opt/oai-nr-ue/etc/rrc/

--- a/ci-scripts/yaml_files/5g_rfsimulator_fr2_32prb/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_fr2_32prb/docker-compose.yaml
@@ -83,8 +83,9 @@ services:

    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -101,13 +102,19 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim
                                    --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
                                    -r 32 --numerology 3 --band 261 -C 27533160000 --ssb 73
            ASAN_OPTIONS: detect_leaks=0
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        depends_on:

--- a/ci-scripts/yaml_files/5g_rfsimulator_tdd_dora/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_tdd_dora/docker-compose.yaml
 services:
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --do-ra --rfsim --rfsimulator.wait_timeout 20 --noS1 --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
        networks:
            public_net:
                ipv4_address: 192.168.71.140
+        devices:
+            - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/gnb.band78.106prb.rfsim.phytest-dora.conf:/opt/oai-gnb/etc/gnb.conf
            - rrc.config:/opt/oai-gnb/
@@ -20,11 +26,17 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --do-ra --rfsim --noS1 --reconfig-file etc/rrc/reconfig.raw --rbconfig-file etc/rrc/rbconfig.raw --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
+        devices:
+            - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
            - rrc.config:/opt/oai-nr-ue/etc/rrc/

--- a/ci-scripts/yaml_files/5g_rfsimulator_u0_25prb/docker-compose.yaml
+++ b/ci-scripts/yaml_files/5g_rfsimulator_u0_25prb/docker-compose.yaml
@@ -82,8 +82,9 @@ services:
            retries: 5
    oai-gnb:
        image: oaisoftwarealliance/oai-gnb:develop
-        privileged: true
        container_name: rfsim5g-oai-gnb
+        cap_drop:
+            - ALL
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim --log_config.global_log_options level,nocolor,time
            ASAN_OPTIONS: detect_leaks=0
@@ -102,8 +103,12 @@ services:

    oai-nr-ue:
        image: oaisoftwarealliance/oai-nr-ue:develop
-        privileged: true
        container_name: rfsim5g-oai-nr-ue
+        cap_drop:
+            - ALL
+        cap_add:
+            - NET_ADMIN  # for interface bringup
+            - NET_RAW    # for ping
        environment:
            USE_ADDITIONAL_OPTIONS: --sa --rfsim -r 25 --numerology 0 --uicc0.imsi 208990100001100 --band 66 -C 2152680000 --CO -400000000 --ssb 48 --rfsimulator.serveraddr 192.168.71.140 --log_config.global_log_options level,nocolor,time
        depends_on:
@@ -111,6 +116,8 @@ services:
        networks:
            public_net:
                ipv4_address: 192.168.71.150
+        devices:
+             - /dev/net/tun:/dev/net/tun
        volumes:
            - ../../conf_files/nrue.uicc.conf:/opt/oai-nr-ue/etc/nr-ue.conf
        healthcheck: