Privileged containers and capabilities

docker linux-kernel kubernetes linux-capabilities
codefx picture codefx · Apr 5, 2016 · Viewed 80.8k times · Source

If I am running a container in privileged mode, does it have all the Kernel capabilities or do I need to add them separately?

Answer

buddy123 picture buddy123 · Apr 6, 2016

Running in privileged mode indeed gives the container all capabilities. But it is good practice to always give a container the minimum requirements it needs.

If you look at Docker docs they also refer to this flag:

Full container capabilities (--privileged)

The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

You can give specific capabilities using --cap-add flag. See man 7 capabilities for more info on those capabilities. The literal names can be used, e.g. --cap-add CAP_FOWNER.

Related questions

Running docker on Android

With Android 4.4 KitKat, Google is upgrading linux kernel to version 3.8 which is the required kernel version for Docker. I don't know the AUFS part but will there be a way to run docker containers on android with this update?

Read More
Memory Limit and CPU Limit in Docker Container

UPDATE: found a lot of questions and discussions on stackoverflow about this topic. And although they are marked as accepted answered and started by thousands of users, they do not seem to be the right answer here. I ran a …

Read More
How does Docker run a Linux kernel under macOS host?

I installed Docker on my macOS Sierra as follows. Note I don't have VirtualBox installed. brew cask uninstall virtualbox brew cask install docker My macOS details. $ uname -a Darwin m-C02QG7TRG8WN.local 16.5.0 Darwin Kernel Version 16.5.0: Fri Mar 3 16:52:33 PST 2017; …

Read More