Capabilities and privilege control in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Effect of Dropping a Capability in Docker

You run a Docker container with the command:

docker run --rm --cap-drop=NET_RAW alpine ping -c 1 8.8.8.8

What will be the output or result of this command?

Docker

docker run --rm --cap-drop=NET_RAW alpine ping -c 1 8.8.8.8

A The ping command fails with 'ping: socket: Operation not permitted' error.

B The ping command succeeds and shows the ping statistics.

C Docker throws an error: 'unknown capability: NET_RAW'.

D The container starts but ping command is not found.

💡 Hint

Dropping NET_RAW capability disables raw socket creation needed by ping.

The NET_RAW capability allows creating raw sockets. Dropping it prevents ping from working, causing a permission error.

🧠 Conceptual

intermediate

Understanding Privileged Mode in Docker

What is the main effect of running a Docker container with the --privileged flag?

A It limits the container to only the default capabilities for security.

B It grants the container all Linux capabilities and lifts most security restrictions.

C It disables networking inside the container.

D It runs the container with read-only filesystem.

💡 Hint

Think about what 'privileged' means in terms of access rights.

The --privileged flag gives the container almost all capabilities and disables many security restrictions, allowing full access to host resources.

❓ Configuration

advanced

Configuring a Docker Container to Add a Capability

You want to run a container that needs the ability to change system time. Which Docker run option correctly adds the required capability?

A docker run --privileged=false alpine date

B docker run --cap-drop=SYS_TIME alpine date

C docker run --cap-add=SYS_TIME alpine date

D docker run --cap-add=NET_ADMIN alpine date

💡 Hint

Changing system time requires SYS_TIME capability.

The SYS_TIME capability allows changing the system clock. Adding it with --cap-add=SYS_TIME enables this inside the container.

❓ Troubleshoot

advanced

Diagnosing Permission Issues with Docker Capabilities

A containerized application fails with 'Operation not permitted' when trying to modify network interfaces. The container was started with:

docker run --rm --cap-drop=NET_ADMIN myapp

What is the cause of the failure?

A The image 'myapp' does not have ping installed.

B The container lacks SYS_ADMIN capability needed for network changes.

C The container must be run with --privileged to modify network.

D Dropping NET_ADMIN capability prevents network interface modifications.

💡 Hint

NET_ADMIN controls network administration tasks.

NET_ADMIN capability is required to modify network interfaces. Dropping it causes permission errors for such operations.

✅ Best Practice

expert

Security Best Practice for Running Containers with Capabilities

Which practice best improves container security regarding Linux capabilities?

A Start containers with no capabilities and add only those strictly required.

B Use default capabilities and never modify them.

C Always run containers with --privileged for full functionality.

D Start containers with all capabilities and drop them as needed.

💡 Hint

Think about the principle of least privilege.

Starting containers with no capabilities and adding only those needed minimizes attack surface and improves security.