title: --cap-add in Google Container Engine
body: <p>I am running into an issue with Google Container Engine where I am unable to add capabilities to the running of my Docker container.</p>
  
  <p>I need to be able to alter the <code>iptables</code> so that I can forward traffic through my Docker VPN container.</p>
  
  <p>The docker container runs fine when I am able to pass --cap-add=NET_ADMIN into the run command, but since GCE is (seemingly) only able to run images this does not seem possible. I get an insufficient permissions error when running my docker image and so it fails to deploy. </p>
  
  <p>Is there anyway around this so I can alter the<code>iptables</code>? Or does GCE just not have this ability?</p>
  
  <p>I have checked out this <a href="https://github.com/docker/docker/issues/1916" rel="nofollow">issue</a>. Which references building an image with privileges but it doesn't seem to be close to resolved.</p>
  
  <p>My <code>iptables</code> commands for reference:</p>
  
  <p><code>iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT</code></p>
  
  <p><code>iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE</code></p>