# Privileged containers

**URL:** <https://forums.docker.com/t/privileged-containers/36935>\
**Category:** Swarm\
**Created:** [August 22, 2017, 1:43pm UTC](https://forums.docker.com/t/privileged-containers/36935 "2017-08-22T13:43:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jiridudekusy](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/jiridudekusy/32/16925_2.png) [@jiridudekusy](https://forums.docker.com/u/jiridudekusy)\
**Post date:** [August 22, 2017, 1:43pm UTC](https://forums.docker.com/t/privileged-containers/36935/1 "2017-08-22T13:43:01Z")

</div>

Hello,  
is there any way how to run privileged containers orchestered by docker swarm ? When i try deploy them via docker-compose i get information them compose is not able to deploy them to other swarm nodes and i have to use docker stack deploy. However when i use docker stqck deploy i get : Ignoring unsupported options: privileged .

---

<div class="post-metadata">

**Author:** ![smakam](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/smakam/32/16669_2.png) [@smakam](https://forums.docker.com/u/smakam)\
**Post date:** [August 24, 2017, 12:13pm UTC](https://forums.docker.com/t/privileged-containers/36935/2 "2017-08-24T12:13:28Z")

</div>

Currently, privileged services are not supported. There is a PR in works([https://github.com/moby/moby/issues/24862](https://github.com/moby/moby/issues/24862)). 1 option that works in some applications like monitoring is to deploy the monitoring container in privileged mode and have it in the same network as other services in swarm mode.

---

<div class="post-metadata">

**Author:** ![ambs](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/ambs/32/29571_2.png) [@ambs](https://forums.docker.com/u/ambs)\
**Post date:** [March 2, 2021, 2:17pm UTC](https://forums.docker.com/t/privileged-containers/36935/3 "2021-03-02T14:17:15Z")

</div>

After three years, what is the status of privileged mode in swarm?

---

<div class="post-metadata">

**Author:** ![francishg](https://avatars.discourse-cdn.com/v4/letter/f/f05b48/32.png) [@francishg](https://forums.docker.com/u/francishg)\
**Post date:** [March 8, 2021, 4:43am UTC](https://forums.docker.com/t/privileged-containers/36935/4 "2021-03-08T04:43:39Z")

</div>

I have also been recently trying to find this answer, and to my knowledge unfortunately Docker Compose still does not support this option. It is due to the fact of how easy it is to make a container/service privileged, and the security vulnerabilities which lie in privileged mode. It is better to add capacities until the needs of the image are satisfied. Unfortunate for me, I’m not sure what capabilities are needed, so my image is not working.

---

<div class="post-metadata">

**Author:** ![uday1kiran](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/uday1kiran/32/24571_2.png) [@uday1kiran](https://forums.docker.com/u/uday1kiran)\
**Post date:** [July 2, 2021, 1:41pm UTC](https://forums.docker.com/t/privileged-containers/36935/6 "2021-07-02T13:41:14Z")

</div>

I didn’t find any solution from any links. Can anyone please post a solution here for swarm

---

<div class="post-metadata">

**Author:** ![meyay](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/meyay/32/34000_2.png) [@meyay](https://forums.docker.com/u/meyay)\
**Post date:** [July 2, 2021, 3:16pm UTC](https://forums.docker.com/t/privileged-containers/36935/7 "2021-07-02T15:16:50Z")

</div>

Swarm never supported privliged containers, see: [https://github.com/moby/moby/issues/25303](https://github.com/moby/moby/issues/25303)

Though, I remember that swarm services recently added [–cap-add](https://docs.docker.com/engine/reference/commandline/service_create/), which allows to add capabilities one by one.

Oddly, the [Compose File refence v3](https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop) explicitly says that cap\_add is ignored for Swarm Stack deployments.

---

<div class="post-metadata">

**Author:** ![meyay](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/meyay/32/34000_2.png) [@meyay](https://forums.docker.com/u/meyay)\
**Post date:** [July 3, 2021, 7:49pm UTC](https://forums.docker.com/t/privileged-containers/36935/8 "2021-07-03T19:49:23Z")

</div>

> [@meyay](#):
>
> Oddly, the [Compose File refence v3](https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop) explicitly says that cap\_add is ignored for Swarm Stack deployments.

That’s a docu bug! It works!

Here is the test:

```auto
cat << EOF | docker stack deploy --compose-file - caps_test
version: '3.9'
services:
  libcap:
    image: alpine
    deploy:
      restart_policy: 
        condition: none
    command: >
      sh -c "apk add --force --update-cache libcap
      && capsh --print"
EOF
cat << EOF | docker stack deploy --compose-file - caps_test
version: '3.9'
services:
  libcap:
    image: alpine
    deploy:
      restart_policy: 
        condition: none
    cap_add:
      - NET_ADMIN
    command: >
      sh -c "apk add --force --update-cache libcap
      && capsh --print"
EOF
docker service logs -f caps_test_libcap
```

This should deploy the service twice. You should be able to see the first and second log outputs (at least I do), though the second has additionaly `cap_net_admin` in the `Current` section.

After performing the test, don’t forget to cleanup the stack:

```auto
docker stack rm caps_test
```