Add privileged flag for internal / dev use

Some usages of agent will require the agent container to have permissions elevated beyond cap NET_ADMIN. This can now be accessed by modifying the following environment variable and invoking ecs-init: ` export ECS_AGENT_RUN_PRIVILEGED=true ` This is not recommended for general use and may be removed in future versions of ecs-init.

Author: petderek

ecs-init/cache/dependencies_mocks.go

@@ -228,6 +228,13 @@ func InstanceConfigFile() string {
 return InstanceConfigDirectory() + "/ecs.config"
 }
 
+// RunPrivileged returns if agent should be invoked with '--privileged'. This is not
+// recommended and may be removed in future versions of amazon-ecs-init.
+func RunPrivileged() bool {
+envVar := os.Getenv("ECS_AGENT_RUN_PRIVILEGED")
+return envVar == "true"
+}
+
 func agentArtifactName(version string, arch string) (string, error) {
 var interpose string
 switch arch {

ecs-init/config/common.go

@@ -177,3 +177,30 @@ func TestAgentRemoteTarballKey(t *testing.T) {
 })
 }
 }
+
+func TestAgentPrivileged(t *testing.T) {
+os.Setenv("ECS_AGENT_RUN_PRIVILEGED", "true")
+defer os.Unsetenv("ECS_AGENT_RUN_PRIVILEGED")
+
+if !RunPrivileged() {
+t.Fatalf("Agent was expected to be running with privileged mode")
+}
+}
+
+func TestAgentPrivilegedNotConfigured(t *testing.T) {
+defer os.Unsetenv("ECS_AGENT_RUN_PRIVILEGED")
+cases := []string{
+"false",
+"unrelated_word",
+"1",
+"",
+}
+
+for _, test := range cases {
+os.Setenv("ECS_AGENT_RUN_PRIVILEGED", test)
+
+if RunPrivileged() {
+t.Errorf("Agent was expected to be running without privileged mode. Testcase (%s)", test)
+}
+}
+}

ecs-init/config/common_test.go

@@ -44,12 +44,18 @@ func createHostConfig(binds []string) *godocker.HostConfig {
 
 logConfig := config.AgentDockerLogDriverConfiguration()
 
-return &godocker.HostConfig{
+hostConfig := &godocker.HostConfig{
 LogConfig: logConfig,
 Binds: binds,
 NetworkMode: networkMode,
 UsernsMode: usernsMode,
 CapAdd: []string{CapNetAdmin, CapSysAdmin},
 Init: true,
 }
+
+if config.RunPrivileged() {
+hostConfig.Privileged = true
+}
+
+return hostConfig
 }