SaaShup/netbox-docker-plugin

Add `NET_RAW` to the Cap add capability list

Open

#234 opened on Apr 28, 2026

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Python (12 forks)auto 404
V4enhancementgood first issuehelp wanted

Repository metrics

Stars
 (78 stars)
PR merge metrics
 (PR metrics pending)

Description

When creating a new container via the plugin UI (/plugins/docker/containers/add/), the Cap add dropdown does not include NET_RAW. The list currently exposes capabilities such as NET_ADMIN, CHOWN, DAC_OVERRIDE, DAC_READ_SEARCH, FOWNER, FSETID, etc., but NET_RAW is absent.

CAP_NET_RAW controls the use of RAW and PACKET sockets and the ability to bind to any address for transparent proxying. It is required by tools such as ping, tcpdump, raw-socket-based health checks, and various network-diagnostic / VPN workloads.

While NET_RAW is part of Docker's default capability set, the standard hardening pattern is:

cap_drop:
  - ALL
cap_add:
  - NET_RAW

Without NET_RAW exposed in the Cap add picker, this pattern cannot be expressed through the NetBox UI or API

Steps to reproduce

  1. Navigate to Docker → Containers → + (Add a new container).
  2. Open the Cap add dropdown.
  3. Observe that NET_RAW is not present in the list.

Contributor guide

Research direction
Locate the source file that defines the list of Cap add dropdown options (likely a choices list or a model field definition). Add 'NET RAW' to that list. Verify consistency with Docker's capability enumeration and update any related documentation or tests.
Tech stack
pythondocker
Domain
backenddevops
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonDockerNetBox Plugin Development
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80