How to set Linux capabilities on docker swarm mode service invocations

I'm looking into the notion of vault running under swarm (1.12.x).

A single container would be started with: docker run -d --cap-add IPC_LOCK -p 8200:8200 -p 8215:8125 --name vault --volume /vagrant/vault:/vagrant/vault vault server -config=/path/to/vault.hcl

but when I want to run this in swarm as a service, there appears to be no way to specify the IPC_LOCK capability, in order to lock down encrypted swapping for the vault service in this case.

How can I set --cap-add flags when starting a swarm mode service with the docker service create command?

As of 20.10, this is available from docker service create with --cap-add:

$ docker service create --help
...
      --cap-add list                       Add Linux capabilities
      --cap-drop list                      Drop Linux capabilities

Or in a compose file used with docker stack deploy with the same syntax from the version 2 file:

version: "3.9"
services:
  app:
    image: your-image:tag
    cap_add:
    - CAP_NAME1
    - CAP_NAME2
    cap_drop:
    - CAP_NAME3
    - CAP_NAME4

[ Original answer from before 20.10 ]

It's currently not supported, but Docker is working on a solution. The logic behind not including the --cap-add option blindly is in a large cluster, there could be security concerns of a manager submitting containers with added privileges to a worker. The worker may trust running secure containers that can't access the host, but not want to allow remote root access to the host via a privileged container.

Discussion on this is over on github at:

https://github.com/docker/docker/pull/26849#issuecomment-252704844

https://github.com/docker/swarmkit/issues/1030

https://github.com/docker/swarmkit/pull/1722

https://github.com/moby/moby/issues/25885#issuecomment-557790402 and https://github.com/docker/cli/pull/2199

All of the other answers here are old. Docker 20.10.0 and newer now supports specifying capabilities for Swarm services via the docker service command line and the Docker Stack YAML file format.

On the command line, you just specify --cap-add [capability] or --cap-drop [capability].

And here is an example for adding a capability in a Docker Stack YAML file:

version: "3.9"
services:
  your-service:
    cap_add:
      - CAP_SYS_ADMIN