38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
--- a/daemon/pkg/oci/caps/utils.go
|
|
+++ b/daemon/pkg/oci/caps/utils.go
|
|
@@ -93,16 +93,24 @@ func TweakCapabilities(basics, adds, drops []string, privileged bool) ([]string,
|
|
|
|
var caps []string
|
|
|
|
+ // Build a set from capDrop so membership tests are O(1) instead of O(n).
|
|
+ dropSet := make(map[string]struct{}, len(capDrop))
|
|
+ for _, c := range capDrop {
|
|
+ dropSet[c] = struct{}{}
|
|
+ }
|
|
+ addSet := make(map[string]struct{}, len(capAdd))
|
|
+ for _, c := range capAdd {
|
|
+ addSet[c] = struct{}{}
|
|
+ }
|
|
+
|
|
switch {
|
|
- case slices.Contains(capAdd, allCapabilities):
|
|
+ case func() bool { _, ok := addSet[allCapabilities]; return ok }():
|
|
// Add all capabilities except ones on capDrop
|
|
for _, c := range GetAllCapabilities() {
|
|
- if !slices.Contains(capDrop, c) {
|
|
+ if _, dropped := dropSet[c]; !dropped {
|
|
caps = append(caps, c)
|
|
}
|
|
}
|
|
- case slices.Contains(capDrop, allCapabilities):
|
|
+ case func() bool { _, ok := dropSet[allCapabilities]; return ok }():
|
|
// "Drop" all capabilities; use what's in capAdd instead
|
|
caps = capAdd
|
|
default:
|
|
// First drop some capabilities
|
|
for _, c := range basics {
|
|
- if !slices.Contains(capDrop, c) {
|
|
+ if _, dropped := dropSet[c]; !dropped {
|
|
caps = append(caps, c)
|
|
}
|
|
}
|