Adds new variable to allow enabling control of system clock

README.md

@@ -190,6 +190,25 @@ following during startup:
 > NTS-KE session with 164.67.62.194:4460 (tick.ucla.edu) timed out
 
 
+## Enable control of system clock
+
+This option enables the control of the system clock.
+
+By default, chronyd will not try to make any adjustments of the clock. It will assume the clock is free running
+and still track its offset and frequency relative to the estimated true time. This allows chronyd to run without
+the capability to adjust or set the system clock in order to operate as an NTP server.
+
+Enabling the control requires granting SYS_TIME capability and a container run-time allowing that access:
+
+```yaml
+  ...
+  cap_add:
+    - SYS_TIME
+  environment:
+    - ENABLE_SYSCLK=true
+    ...
+```
+
 ## Testing your NTP Container
 
 From any machine that has `ntpdate` you can query your new NTP container with the follow

assets/startup.sh

@@ -80,5 +80,11 @@ done
   echo "allow all"
 } >> ${CHRONY_CONF_FILE}
 
+# enable control of system clock, disabled by default
+SYSCLK="-x"
+if [[ "${ENABLE_SYSCLK:-false}" = true ]]; then
+  SYSCLK=""
+fi
+
 ## startup chronyd in the foreground
-exec /usr/sbin/chronyd -u chrony -d -x -L ${LOG_LEVEL}
+exec /usr/sbin/chronyd -u chrony -d ${SYSCLK} -L ${LOG_LEVEL}

docker-compose.yml

@@ -14,3 +14,4 @@ services:
 #      - TZ=America/Vancouver
 #      - NOCLIENTLOG=true
 #      - ENABLE_NTS=true
+#      - ENABLE_SYSCLK=true

run.sh

@@ -18,8 +18,10 @@ function start_container() {
               --publish=123:123/udp                \
               --env=NTP_SERVERS=${NTP_SERVERS}     \
               --env=ENABLE_NTS=${ENABLE_NTS}       \
+              --env=ENABLE_SYSCLK=${ENABLE_SYSCLK} \
               --env=NOCLIENTLOG=${NOCLIENTLOG}     \
               --env=LOG_LEVEL=${LOG_LEVEL}         \
+              --cap-add=SYS_TIME                   \
               --read-only=true                     \
               --tmpfs=/etc/chrony:rw,mode=1750     \
               --tmpfs=/run/chrony:rw,mode=1750     \

vars

@@ -15,6 +15,9 @@ NTP_SERVERS="0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org"
 # (optional) enable NTS in the chronyd configuration file
 ENABLE_NTS=false
 
+# (optional) enable control of system clock
+ENABLE_SYSCLK=true
+
 # (optional) turn on noclientlog option
 NOCLIENTLOG=false