Privileged containers and capabilities

by

Running in privileged mode indeed gives the container all capabilities.
But it is good practice to always give a container the minimum requirements it needs.

The Docker run command documentation refers to this flag:

Full container capabilities (–privileged)

The –privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

You can give specific capabilities using --cap-add flag. See man 7 capabilities for more info on those capabilities. The literal names can be used, e.g. --cap-add CAP_FOWNER.

More Related Contents:

  1. How can I keep a container running on Kubernetes?
  2. Kubernetes how to make Deployment to update image
  3. How to run kubectl commands inside a container?
  4. How to share storage between Kubernetes pods?
  5. Kubernetes Pod Warning: 1 node(s) had volume node affinity conflict
  6. Pass environment variable into a Vue App at runtime
  7. Pull a local image to run a pod in Kubernetes
  8. Kubenetes: Is it possible to hit multiple pods with a single request in Kubernetes cluster
  9. What work does the process in container “gcr.io/google_containers/pause:0.8.0” do?
  10. How to mimic ‘–volumes-from’ in Kubernetes
  11. How to copy files from host to Docker container?
  12. Add a volume to Docker, but exclude a sub-folder
  13. How to change the docker image installation directory?
  14. Docker Compose – Share named volume between multiple containers
  15. How to keep Docker container running after starting services?
  16. How to show the run command of a docker container
  17. Docker remove TAG images
  18. Conditional ENV in Dockerfile
  19. Linux machine with docker deploy windows container
  20. docker data volume vs mounted host directory
  21. Is there a best practice on setting up glibc on docker alpine linux base image?
  22. How do I access a spring app running in a docker container?
  23. How to get ENV variable when doing Docker Inspect
  24. How to pass ARG value to ENTRYPOINT?
  25. Multiple commands on docker ENTRYPOINT
  26. How can I use environment variables in docker-compose?
  27. Pass argument to docker compose
  28. Differences Between Dockerfile Instructions in Shell and Exec Form
  29. What is meant by shared kernel in Docker?
  30. Multiple Docker containers and Celery

Leave a Comment