[docker_image_ctl.j2] Share UTS namespace with host OS (#4169)

[qiluo-msft]

• TODO: after merged this PR, we need to cherry-pick below into 201811

41ae7a21 2020-02-29 | [snmp] remove hostname change as it share uts namespace with host (#4206) [Stepan Blyshchak]

Instead of updating hostname manualy on Config DB hostname change,
simply share containers UTS namespace with host OS.
Ideally, instead of setting --uts=host for every container in SONiC,
this setting can be set per container if feature requires.
One behaviour change is introduced in this commit, when --privileged
or --cap-add=CAP_SYS_ADMIN and --uts=host are combined, container
has privilege to change host OS and every other container hostname.
Such privilege should be fixed by limiting containers capabilities.

Signed-off-by: Stepan Blyschak [email protected]

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

[jleveque]

Can you think of an instance where we would not want to share the host's UTS namespace?

[qiluo-msft]

I cannot 😄
This is a modified cherry-pick following master branch.

---

In reply to: 387377484 [](ancestors = 387377484)

[jleveque]

😄 Then maybe add a "maybe" to the beginning of the comment?

[stepanblyschak]

@jleveque @qiluo-msft I think swss, syncd, pmon don't need to care about the hostname, if they do IMO it looks like a design mistake. The idea behind docker containers is isolation, why do we need docker containers at all if we want to share and map inside container almost everything?
Besides, --priviledge + --uts=host will give container priviledges to change host OS hostname.
The only containers I know which need host's hostname inside container are snmp and dhcp_relay but it doesn't look like they need --priviledge option or do they?
I would like to keep this comment and revise containers isolation in sonic in general in the future.

[lguohan]

why do we need this in 201811?

[qiluo-msft]

Closed since we already fixed it in #4241 and this PR is not needed.