[SOLVED] Privileged containers and capabilities

Issue

If I am running a container in privileged mode, does it have all the Kernel capabilities or do I need to add them separately?

Solution

Running in privileged mode indeed gives the container all capabilities. But it is good practice to always give a container the minimum requirements it needs.

The Docker run command documentation refers to this flag:

Full container capabilities (--privileged)

The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

You can give specific capabilities using --cap-add flag. See man 7 capabilities for more info on those capabilities. The literal names can be used, e.g. --cap-add CAP_FOWNER.

Answered By - buddy123

Answer Checked By - Willingham (WPSolving Volunteer)