# Packetbeat docker image 'help' and 'setup' subcommands fail without --cap-add=NET\_ADMIN
**URL:** https://discuss.elastic.co/t/packetbeat-docker-image-help-and-setup-subcommands-fail-without-cap-add-net-admin/225314
**Category:** Beats
**Tags:** docker, packetbeat
**Created:** [March 27, 2020, 12:16am UTC](https://discuss.elastic.co/t/packetbeat-docker-image-help-and-setup-subcommands-fail-without-cap-add-net-admin/225314 "2020-03-27T00:16:47Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@wfhartford](https://discuss.elastic.co/u/wfhartford)
#### Post date: [March 27, 2020, 12:16am UTC](https://discuss.elastic.co/t/packetbeat-docker-image-help-and-setup-subcommands-fail-without-cap-add-net-admin/225314/1 "2020-03-27T00:16:47Z")
The packetbeat docker image normally requires that the flag `--cap-add=NET_ADMIN` be passed in order to capture packets. This is understandable and expected when packet capture is actually being performed, however the docker command fails if that permission is not provided even for the `help` and `setup` sub-commands:
```auto
/usr/local/bin/docker-entrypoint: line 13: /usr/share/packetbeat/packetbeat: Operation not permitted
```
Is there any way to execute the `setup` command without providing the docker container with elevated privileges? I want to perform the setup in a cluster with limited access and don't want to give the container these permissions where it should not be necessary.
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [April 1, 2020, 11:21am UTC](https://discuss.elastic.co/t/packetbeat-docker-image-help-and-setup-subcommands-fail-without-cap-add-net-admin/225314/2 "2020-04-01T11:21:02Z")
You can build a dedicated docker image to just run setup on top of your Packetbeat image of choice.
What's preventing you from running `setup` without CAP\_NET\_ADMIN is the file capabilities on the packetbeat executable. You can build an image that required lowered permissions with a Dockerfile like this:
```auto
FROM docker.elastic.co/beats/packetbeat:7.6.1
USER root
RUN setcap -r /usr/share/packetbeat/packetbeat
USER packetbeat
```
This is my output:
```bash
test$ cat Dockerfile
FROM docker.elastic.co/beats/packetbeat:7.6.1
USER root
RUN setcap -r /usr/share/packetbeat/packetbeat
USER packetbeat
test$ docker build . -t packetbeat_setup
Sending build context to Docker daemon 2.048kB
Step 1/4 : FROM docker.elastic.co/beats/packetbeat:7.6.1
---> dd12ef9983ca
Step 2/4 : USER root
---> Using cache
---> b8728e46cc14
Step 3/4 : RUN setcap -r /usr/share/packetbeat/packetbeat
---> Using cache
---> b916d58c634f
Step 4/4 : USER packetbeat
---> Using cache
---> 903ef61fe13e
Successfully built 903ef61fe13e
Successfully tagged packetbeat_setup:latest
test$
test$ docker run packetbeat_setup setup
Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch http://elasticsearch:9200: Get http://elasticsearch:9200: lookup elasticsearch on 192.168.65.1:53: no such host]
```
---
### Author:  [@wfhartford](https://discuss.elastic.co/u/wfhartford)
#### Post date: [April 1, 2020, 6:47pm UTC](https://discuss.elastic.co/t/packetbeat-docker-image-help-and-setup-subcommands-fail-without-cap-add-net-admin/225314/3 "2020-04-01T18:47:57Z")
This looks like a great solution, thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2020, 6:48pm UTC](https://discuss.elastic.co/t/packetbeat-docker-image-help-and-setup-subcommands-fail-without-cap-add-net-admin/225314/4 "2020-04-29T18:48:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.