Docker - Security
You want to run a container that can mount filesystems but nothing else. Which capability should you add explicitly after dropping all capabilities?
You want to run a container that can mount filesystems but nothing else. Which capability should you add explicitly after dropping all capabilities?
hard📝 Workflow Q8 of 15
Step-by-Step Solution
Solution:
Step 1: Identify capability needed for mounting filesystems
TheSYS_ADMINcapability allows mounting and unmounting filesystems.Step 2: Confirm other options are unrelated
NET_ADMIN is for network, CHOWN for changing ownership, SYS_TIME for changing system time.Final Answer:
SYS_ADMIN -> Option BQuick Check:
Mounting requires SYS_ADMIN capability [OK]
Quick Trick: Add SYS_ADMIN to allow mounting filesystems [OK]
Common Mistakes:
- Choosing NET_ADMIN for mounting
- Confusing CHOWN with mount permissions
- Ignoring SYS_ADMIN's broad privileges
Master "Security" in Docker
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore Docker Quizzes