Lesson 4.35: Privileged containers and capabilities
Root inside a container is still root to the kernel; what keeps it in its box is a reduced set of capabilities, seccomp, AppArmor and namespaces. --privileged switches almost all of that off, and a single extra capability like SYS_ADMIN reopens much of it. In the lab three containers run on the shop's container host. You read their settings and their real capability sets from /proc, decode the bit masks, and start the two risky ones again with only what they need.
18 min
You will learn to
- Read Privileged and CapAdd with docker inspect
- Read a process's capability set from /proc/PID/status
- Decode a capability mask with capsh
- Explain why SYS_ADMIN is close to privileged
- Run a container with --cap-drop ALL and only the capabilities it needs
Key terms
- Capability
- One slice of root's power, checked by the kernel separately (e.g. CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN).
- CapEff
- The effective capability bit mask of a process, in /proc/PID/status.
- --privileged
- Docker option: all capabilities, all devices, no seccomp or AppArmor confinement.
- CAP_SYS_ADMIN
- The catch-all administrative capability: mount, namespaces, many device and kernel operations.
- capsh --decode
- Turns a capability mask into names.
- --cap-drop ALL
- Start a container with no capabilities; add back single ones with --cap-add.
← Seccomp: a system call allow-list · All lessons · Backups and recovery →