agent/app/agent_capability.go
func (agent *ecsAgent) capabilities() ([]*ecs.Attribute, error) {
	var capabilities []*ecs.Attribute

	if !agent.cfg.PrivilegedDisabled {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"privileged-container")
	}

	supportedVersions := make(map[dockerclient.DockerVersion]bool)
	// Determine API versions to report as supported. Supported versions are also used for capability-enablement, except
	// logging drivers.
	for _, version := range agent.dockerClient.SupportedVersions() {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"docker-remote-api."+string(version))
		supportedVersions[version] = true
	}

	capabilities = agent.appendLoggingDriverCapabilities(capabilities)

	if agent.cfg.SELinuxCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"selinux")
	}
	if agent.cfg.AppArmorCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"apparmor")
	}

	capabilities = agent.appendTaskIamRoleCapabilities(capabilities, supportedVersions)

	capabilities, err := agent.appendTaskCPUMemLimitCapabilities(capabilities, supportedVersions)
	if err != nil {
		return nil, err
	}

	capabilities = agent.appendTaskENICapabilities(capabilities)
	capabilities = agent.appendDockerDependentCapabilities(capabilities, supportedVersions)

	// TODO: gate this on docker api version when ecs supported docker includes
	// credentials endpoint feature from upstream docker
	if agent.cfg.OverrideAWSLogsExecutionRole {
		capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+"execution-role-awslogs")
	}

	capabilities = agent.appendVolumeDriverCapabilities(capabilities)

	// ecs agent version 1.19.0 supports private registry authentication using
	// aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityPrivateRegistryAuthASM)

	// ecs agent version 1.22.0 supports ecs secrets integrating with aws systems manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvSSM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverSSM)

	// ecs agent version 1.22.0 supports sharing PID namespaces and IPC resource namespaces
	// with host EC2 instance and among containers within the task
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabiltyPIDAndIPCNamespaceSharing)

	if agent.cfg.GPUSupportEnabled {
		capabilities = agent.appendNvidiaDriverVersionAttribute(capabilities)
	}
	// support ecr endpoint override
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityECREndpoint)

	// ecs agent version 1.23.0 supports ecs secrets integrating with aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvASM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverASM)

	// ecs agent version 1.26.0 supports aws-appmesh cni plugin
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+appMeshAttributeSuffix)

	// support elastic inference in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+taskEIAAttributeSuffix)

	// support container ordering in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityContainerOrdering)

	return capabilities, nil
}
func (agent *ecsAgent) capabilities() ([]*ecs.Attribute, error) {
	var capabilities []*ecs.Attribute

	if !agent.cfg.PrivilegedDisabled {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"privileged-container")
	}

	supportedVersions := make(map[dockerclient.DockerVersion]bool)
	// Determine API versions to report as supported. Supported versions are also used for capability-enablement, except
	// logging drivers.
	for _, version := range agent.dockerClient.SupportedVersions() {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"docker-remote-api."+string(version))
		supportedVersions[version] = true
	}

	capabilities = agent.appendLoggingDriverCapabilities(capabilities)

	if agent.cfg.SELinuxCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"selinux")
	}
	if agent.cfg.AppArmorCapable {
		capabilities = appendNameOnlyAttribute(capabilities, capabilityPrefix+"apparmor")
	}

	capabilities = agent.appendTaskIamRoleCapabilities(capabilities, supportedVersions)

	capabilities, err := agent.appendTaskCPUMemLimitCapabilities(capabilities, supportedVersions)
	if err != nil {
		return nil, err
	}

	capabilities = agent.appendTaskENICapabilities(capabilities)
	capabilities = agent.appendDockerDependentCapabilities(capabilities, supportedVersions)

	// TODO: gate this on docker api version when ecs supported docker includes
	// credentials endpoint feature from upstream docker
	if agent.cfg.OverrideAWSLogsExecutionRole {
		capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+"execution-role-awslogs")
	}

	capabilities = agent.appendVolumeDriverCapabilities(capabilities)

	// ecs agent version 1.19.0 supports private registry authentication using
	// aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityPrivateRegistryAuthASM)

	// ecs agent version 1.22.0 supports ecs secrets integrating with aws systems manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvSSM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverSSM)

	// ecs agent version 1.22.0 supports sharing PID namespaces and IPC resource namespaces
	// with host EC2 instance and among containers within the task
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabiltyPIDAndIPCNamespaceSharing)

	if agent.cfg.GPUSupportEnabled {
		capabilities = agent.appendNvidiaDriverVersionAttribute(capabilities)
	}
	// support ecr endpoint override
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityECREndpoint)

	// ecs agent version 1.23.0 supports ecs secrets integrating with aws secrets manager
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretEnvASM)

	// ecs agent version 1.27.0 supports ecs secrets for logging drivers
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilitySecretLogDriverASM)

	// ecs agent version 1.26.0 supports aws-appmesh cni plugin
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+appMeshAttributeSuffix)

	// support elastic inference in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+taskEIAAttributeSuffix)

	// support container ordering in agent
	capabilities = appendNameOnlyAttribute(capabilities, attributePrefix+capabilityContainerOrdering)

	return capabilities, nil
}
// capabilities returns the supported capabilities of this agent / docker-client pair.
// Currently, the following capabilities are possible:
//
//    com.amazonaws.ecs.capability.privileged-container
//    com.amazonaws.ecs.capability.docker-remote-api.1.17
//    com.amazonaws.ecs.capability.docker-remote-api.1.18
//    com.amazonaws.ecs.capability.docker-remote-api.1.19
//    com.amazonaws.ecs.capability.docker-remote-api.1.20
//    com.amazonaws.ecs.capability.logging-driver.json-file
//    com.amazonaws.ecs.capability.logging-driver.syslog
//    com.amazonaws.ecs.capability.logging-driver.fluentd
//    com.amazonaws.ecs.capability.logging-driver.journald
//    com.amazonaws.ecs.capability.logging-driver.gelf
//    com.amazonaws.ecs.capability.logging-driver.none
//    com.amazonaws.ecs.capability.selinux
//    com.amazonaws.ecs.capability.apparmor
//    com.amazonaws.ecs.capability.ecr-auth
//    com.amazonaws.ecs.capability.task-iam-role
//    com.amazonaws.ecs.capability.task-iam-role-network-host
//    ecs.capability.docker-volume-driver.${driverName}
//    ecs.capability.task-eni
//    ecs.capability.task-eni-block-instance-metadata
//    ecs.capability.execution-role-ecr-pull
//    ecs.capability.execution-role-awslogs
//    ecs.capability.container-health-check
//    ecs.capability.private-registry-authentication.secretsmanager
//    ecs.capability.secrets.ssm.environment-variables
//    ecs.capability.secrets.ssm.bootstrap.log-driver
//    ecs.capability.pid-ipc-namespace-sharing
//    ecs.capability.ecr-endpoint
//    ecs.capability.secrets.asm.environment-variables
//    ecs.capability.secrets.asm.bootstrap.log-driver
//    ecs.capability.aws-appmesh
//    ecs.capability.task-eia