Capabilities and privilege control in Docker - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of Linux capabilities in Docker containers?

Linux capabilities allow fine-grained control over the privileges a container has, limiting what it can do to improve security.

beginner

How do you drop all Linux capabilities from a Docker container?

Use the flag --cap-drop=ALL when running the container to remove all extra privileges.

intermediate

What does running a Docker container with --privileged do?

It gives the container almost all the host's capabilities, allowing it to perform many sensitive operations, which can be risky.

beginner

Name one reason to avoid using --privileged mode in Docker containers.

Because it grants too many permissions, it can lead to security risks if the container is compromised.

beginner

How can you add a specific capability to a Docker container?

Use the flag --cap-add=CAP_NAME when running the container, replacing CAP_NAME with the capability you want to add.

Which Docker flag removes all Linux capabilities from a container?

A --cap-drop=ALL

B --privileged

C --cap-add=ALL

D --no-capabilities

The --cap-drop=ALL flag removes all capabilities, restricting the container's privileges.

What effect does the --privileged flag have on a Docker container?

A Removes all capabilities

B Adds only network capabilities

C Grants almost all host capabilities

D Runs the container as root user only

The --privileged flag gives the container nearly all capabilities of the host, increasing its power and risk.

Why should you avoid using --privileged unless necessary?

A It slows down the container

B It increases security risks

C It disables networking

D It prevents container startup

Using --privileged increases security risks by giving the container broad access to the host system.

How do you add the capability to allow raw socket access to a Docker container?

A --cap-add=NET_RAW

B --cap-drop=NET_RAW

C --privileged

D --net=host

The --cap-add=NET_RAW flag adds the capability for raw socket access.

What is the default privilege level of Docker containers regarding capabilities?

A Containers run with all capabilities

B Containers run with no capabilities

C Containers run with privileged mode enabled

D Containers run with a limited set of capabilities

By default, Docker containers run with a limited set of capabilities for security.

Explain how Linux capabilities help improve Docker container security.

Think about how giving fewer permissions can protect the host.

Describe the risks and benefits of using the --privileged flag in Docker.

Consider what happens when a container can do almost anything on the host.