is "--cap-add=NET_ADMIN" really needed?

[fakuivan]

The documentation for networks controller suggests that since these don't need to join networks, networking administration capabilities are not necessary.
https://github.com/zerotier/ZeroTierOne/tree/master/controller#dockerizing-controllers

Is this true? If so the setup instructions could be updated to follow the principle of least privilege.

[key-networks]

All that is needed is --cap-add=NET_ADMIN, not --device, nor --privileged. I forget the exact reason why --cap-add=NET_ADMIN was needed, but if you try running the container without that, you will notice certain failures (like the ZeroTier token being inaccessible).

[fakuivan]

I gave this one another go and it turns out you can tell zerotier to not drop privileges and ignore these sort of errors with the -U flag, for this it is recommended to run the executable with sudo as the zerotier-one user and chown everything inside /var/lib/zerotier-one/ to that user before running it, otherwise the program will not be able to write to files in that directory.

[key-networks]

@fakuivan thanks for your feedback.

[mdPlusPlus]

I was able to get it to work without --cap-add=NET_ADMIN:

https://gist.github.com/mdPlusPlus/0f6285c6402aa4aff4aa4a9e5dfc38c0
https://hub.docker.com/r/mdplusplus/zerotier-network-controller-ui

[key-networks]

That's great! Do you mind if I possibly use your Docker file in the next build?

[mdPlusPlus]

Feel free to do so.
However, keep in mind my Dockerfile had readabílity and maintainability as a goal. The resulting image is not space efficient (unnecessary layers, not removing temporary files) and using a long CMD instead of a entrypoint.sh and choosing a moving target (xxx:latest) as a base image are generally frowned upon by the Docker community.

[key-networks]

Great - thanks. I'll keep those points in mind.

[key-networks]

The answer to the subject of this thread is - not any more. Thanks to clues from @mdPlusPlus, the requirement for --cap-add=NET_ADMIN and the clash with Ubuntu UID/GIDs have been circumvented.

[key-networks]

Try latest version here: https://hub.docker.com/r/keynetworks/ztncui