Answers: <p>You're not doing anything wrong, <code>cap_add</code> and <code>devices</code> are ignored when deploying a stack in Swarm mode.  See the Notes section of the following links:</p>
  <p><a href="https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop" rel="nofollow noreferrer">https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop</a>
  <a href="https://docs.docker.com/compose/compose-file/compose-file-v3/#devices" rel="nofollow noreferrer">https://docs.docker.com/compose/compose-file/compose-file-v3/#devices</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-28T12:13:09.580Z
Answers: 2021-10-28T12:13:09.580Z
Answers: swysocki
Body: <p>I am trying to start docker container on the rockpix node with cap_add and device options but docker stack errors  saying</p>
  <pre><code>$ docker stack deploy -c docker-stack.yml vpnproxy
  services.vpn_proxy.deploy Additional property cap_add is not allowed
  $ docker stack deploy -c docker-stack.yml vpnproxy
  services.vpn_proxy.deploy Additional property device is not allowed
  </code></pre>
  <p>Below is my stack file.</p>
  <pre><code>version: &quot;3.9&quot;
  services:
  
    vpn_proxy:
      image: ciasto/alpine-myvpn-proxy:v1
      volumes:
        - /etc/openvpn:/etc/openvpn
        - /etc/haproxy:/etc/haproxy
      networks:
        - vpn_proxy_frontend
      deploy:
        replicas: 1
        update_config:
          parallelism: 2
          delay: 10s
        restart_policy:
          condition: on-failure
        cap_add: NET_ADMIN
        device: /dev/net/tun
        placement:
          constraints:
            - &quot;node.hostname==rockpix&quot;
  
  networks:
    vpn_proxy_frontend:
  </code></pre>
  <p>What am I doing wrong ?</p>
  
Tags: <docker><docker-swarm>
Title: cap_add and device options not working in docker stack file
UserDisplayName: Chang Zhao
ThreadText: # cap_add and device options not working in docker stack file
  
  (Asked by: username_0 on 2021-10-27)
  
  I am trying to start docker container on the rockpix node with cap\_add and device options but docker stack errors saying
  
  ```
  $ docker stack deploy -c docker-stack.yml vpnproxy
  services.vpn_proxy.deploy Additional property cap_add is not allowed
  $ docker stack deploy -c docker-stack.yml vpnproxy
  services.vpn_proxy.deploy Additional property device is not allowed
  
  ```
  
  Below is my stack file.
  
  ```
  version: "3.9"
  services:
  
    vpn_proxy:
      image: ciasto/alpine-myvpn-proxy:v1
      volumes:
        - /etc/openvpn:/etc/openvpn
        - /etc/haproxy:/etc/haproxy
      networks:
        - vpn_proxy_frontend
      deploy:
        replicas: 1
        update_config:
          parallelism: 2
          delay: 10s
        restart_policy:
          condition: on-failure
        cap_add: NET_ADMIN
        device: /dev/net/tun
        placement:
          constraints:
            - "node.hostname==rockpix"
  
  networks:
    vpn_proxy_frontend:
  
  ```
  
  What am I doing wrong ?
  
  **Tags:** docker, docker-swarm
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-10-28. Score: 1
  
  You're not doing anything wrong, `cap_add` and `devices` are ignored when deploying a stack in Swarm mode. See the Notes section of the following links:
  
  <https://docs.docker.com/compose/compose-file/compose-file-v3/#cap_add-cap_drop>
  <https://docs.docker.com/compose/compose-file/compose-file-v3/#devices>
  
  
  ---
  
  