Capabilities and privilege control in Docker - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to run a Docker container with the NET_ADMIN capability added.

Docker

docker run --cap-add=[1] alpine ip link

Drag options to blanks, or click blank then click option'

ANET_ADMIN

BDAC_OVERRIDE

CCHOWN

DSYS_ADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Using SYS_ADMIN instead of NET_ADMIN causes unnecessary privileges.

Omitting --cap-add disables network commands inside the container.

The --cap-add=NET_ADMIN option adds the network administration capability to the container, allowing commands like ip link to work.

2fill in blank

medium

Complete the command to run a Docker container in privileged mode.

Docker

docker run [1] alpine ls /root

Drag options to blanks, or click blank then click option'

A--cap-drop=ALL

B--read-only

C--security-opt=no-new-privileges

D--privileged

Attempts:

3 left

💡 Hint

Common Mistakes

Using --cap-drop=ALL removes all capabilities, restricting the container.

Using --read-only does not grant privileges.

The --privileged flag gives the container all capabilities and lifts many restrictions, allowing full access to the host.

3fill in blank

hard

Fix the error in the command to drop the CHOWN capability from a container.

Docker

docker run --cap-drop=[1] alpine whoami

Drag options to blanks, or click blank then click option'

ACHOWN

BNET_RAW

CSYS_TIME

DSYS_ADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Dropping unrelated capabilities does not affect file ownership.

Using incorrect capability names causes command errors.

The --cap-drop=CHOWN option removes the capability to change file ownership inside the container.

4fill in blank

hard

Fill both blanks to run a container with the SYS_TIME capability added and the NET_RAW capability dropped.

Docker

docker run --cap-add=[1] --cap-drop=[2] alpine date

Drag options to blanks, or click blank then click option'

ASYS_TIME

BNET_ADMIN

CNET_RAW

DSYS_CHROOT

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing NET_ADMIN with NET_RAW.

Dropping SYS_TIME instead of NET_RAW.

--cap-add=SYS_TIME allows changing the system clock inside the container. --cap-drop=NET_RAW removes raw network access capability.

5fill in blank

hard

Fill all three blanks to run a container that adds the SYS_ADMIN capability, drops the MKNOD capability, and disables new privileges.

Docker

docker run --cap-add=[1] --cap-drop=[2] --security-opt=[3] alpine bash

Drag options to blanks, or click blank then click option'

ASYS_ADMIN

BMKNOD

Cno-new-privileges

Dapparmor=unconfined

Attempts:

3 left

💡 Hint

Common Mistakes

Using apparmor=unconfined disables AppArmor but does not disable new privileges.

Dropping SYS_ADMIN instead of MKNOD.

--cap-add=SYS_ADMIN grants administrative capabilities. --cap-drop=MKNOD removes the ability to create device files. --security-opt=no-new-privileges prevents privilege escalation inside the container.

Practice

1. What does the --cap-drop option do when running a Docker container?

easy

A. Removes specific Linux capabilities from the container

B. Adds new capabilities to the container

C. Runs the container with full root privileges

D. Limits the container's CPU usage

Solution

1. Step 1: Understand Docker capabilities

   Capabilities are Linux kernel permissions that control what a container can do on the host.

2. Step 2: Role of --cap-drop

   This option removes specific capabilities from the container, reducing its privileges.

3. Final Answer:

   Removes specific Linux capabilities from the container -> Option A

4. Quick Check:

   --cap-drop means remove capabilities [OK]

Hint: Drop caps to reduce container privileges quickly [OK]

Common Mistakes:

• Confusing --cap-drop with --cap-add
• Thinking it controls CPU or memory
• Assuming it grants root access

2. Which of the following is the correct syntax to add the NET_ADMIN capability to a Docker container?

easy

A. docker run --cap NET_ADMIN myimage

B. docker run --add-cap NET_ADMIN myimage

C. docker run --capability-add NET_ADMIN myimage

D. docker run --cap-add NET_ADMIN myimage

Solution

1. Step 1: Recall Docker capability syntax

   The correct flag to add capabilities is --cap-add.

2. Step 2: Match the correct command

   docker run --cap-add NET_ADMIN myimage uses --cap-add NET_ADMIN, which is the exact syntax Docker expects.

3. Final Answer:

   docker run --cap-add NET_ADMIN myimage -> Option D

4. Quick Check:

   Use --cap-add to add capabilities [OK]

Hint: Remember: add = --cap-add, drop = --cap-drop [OK]

Common Mistakes:

• Using incorrect flags like --add-cap
• Omitting the capability name
• Using --cap or --capability-add which are invalid

3. What will be the effect of running this command?

docker run --cap-drop ALL --cap-add CHOWN alpine id

medium

A. The container has only the CHOWN capability enabled

B. The container has all capabilities except CHOWN

C. The container runs with full root privileges

D. The container will fail to start due to conflicting options

Solution

1. Step 1: Analyze --cap-drop ALL

   This removes all Linux capabilities from the container, making it very restricted.

2. Step 2: Analyze --cap-add CHOWN

   This adds back the CHOWN capability, allowing the container to change file ownership.

3. Final Answer:

   The container has only the CHOWN capability enabled -> Option A

4. Quick Check:

   Drop all then add one = only that one capability [OK]

Hint: Drop ALL then add one = only that one capability [OK]

Common Mistakes:

• Thinking --cap-add adds on top without drop effect
• Assuming container runs with full privileges
• Believing conflicting options cause failure

4. You want to run a container with the SYS_TIME capability but accidentally use this command:

docker run --cap-drop SYS_TIME myimage

What is the problem and how to fix it?

medium

A. Problem: Syntax error in command. Fix: Remove --cap-drop

B. Problem: SYS_TIME is dropped, so container can't change time. Fix: Use --cap-add SYS_TIME

C. Problem: Container runs with full privileges. Fix: Add --cap-drop ALL

D. Problem: SYS_TIME is not a valid capability. Fix: Use a valid capability name

Solution

1. Step 1: Understand the effect of --cap-drop SYS_TIME

   This removes the SYS_TIME capability, preventing the container from changing system time.

2. Step 2: Correct the command to add the capability

   To allow changing time, use --cap-add SYS_TIME instead of dropping it.

3. Final Answer:

   Problem: SYS_TIME is dropped, so container can't change time. Fix: Use --cap-add SYS_TIME -> Option B

4. Quick Check:

   Drop removes, add grants capabilities [OK]

Hint: Add needed caps, don't drop them by mistake [OK]

Common Mistakes:

• Confusing --cap-drop with --cap-add
• Assuming dropping caps grants them
• Thinking SYS_TIME is invalid capability

5. You want to run a container that can modify network settings but nothing else. Which command best limits privileges to only what is needed?

hard

A. docker run --cap-drop NET_ADMIN myimage

B. docker run --privileged myimage

C. docker run --cap-drop ALL --cap-add NET_ADMIN myimage

D. docker run --cap-add ALL myimage

Solution

1. Step 1: Understand the goal

   The container should only have network admin rights, no other privileges.

2. Step 2: Evaluate options

   docker run --cap-drop ALL --cap-add NET_ADMIN myimage drops all capabilities then adds only NET_ADMIN, perfectly limiting privileges.

3. Step 3: Why others are wrong

   --privileged grants full privileges, --cap-add ALL adds all capabilities (too much), --cap-drop NET_ADMIN removes NET_ADMIN (opposite of goal).

4. Final Answer:

   docker run --cap-drop ALL --cap-add NET_ADMIN myimage -> Option C

5. Quick Check:

   Drop all then add needed cap = minimal privileges [OK]

Hint: Drop all caps, then add only needed ones [OK]

Common Mistakes:

• Using --privileged which grants too many rights
• Adding all capabilities instead of limiting
• Dropping the needed capability by mistake