Capabilities and privilege control in Docker - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to run a Docker container with the NET_ADMIN capability added.

Docker

docker run --cap-add=[1] alpine ip link

Drag options to blanks, or click blank then click option'

ANET_ADMIN

BDAC_OVERRIDE

CCHOWN

DSYS_ADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Using SYS_ADMIN instead of NET_ADMIN causes unnecessary privileges.

Omitting --cap-add disables network commands inside the container.

The --cap-add=NET_ADMIN option adds the network administration capability to the container, allowing commands like ip link to work.

2fill in blank

medium

Complete the command to run a Docker container in privileged mode.

Docker

docker run [1] alpine ls /root

Drag options to blanks, or click blank then click option'

A--cap-drop=ALL

B--read-only

C--security-opt=no-new-privileges

D--privileged

Attempts:

3 left

💡 Hint

Common Mistakes

Using --cap-drop=ALL removes all capabilities, restricting the container.

Using --read-only does not grant privileges.

The --privileged flag gives the container all capabilities and lifts many restrictions, allowing full access to the host.

3fill in blank

hard

Fix the error in the command to drop the CHOWN capability from a container.

Docker

docker run --cap-drop=[1] alpine whoami

Drag options to blanks, or click blank then click option'

ACHOWN

BNET_RAW

CSYS_TIME

DSYS_ADMIN

Attempts:

3 left

💡 Hint

Common Mistakes

Dropping unrelated capabilities does not affect file ownership.

Using incorrect capability names causes command errors.

The --cap-drop=CHOWN option removes the capability to change file ownership inside the container.

4fill in blank

hard

Fill both blanks to run a container with the SYS_TIME capability added and the NET_RAW capability dropped.

Docker

docker run --cap-add=[1] --cap-drop=[2] alpine date

Drag options to blanks, or click blank then click option'

ASYS_TIME

BNET_ADMIN

CNET_RAW

DSYS_CHROOT

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing NET_ADMIN with NET_RAW.

Dropping SYS_TIME instead of NET_RAW.

--cap-add=SYS_TIME allows changing the system clock inside the container. --cap-drop=NET_RAW removes raw network access capability.

5fill in blank

hard

Fill all three blanks to run a container that adds the SYS_ADMIN capability, drops the MKNOD capability, and disables new privileges.

Docker

docker run --cap-add=[1] --cap-drop=[2] --security-opt=[3] alpine bash

Drag options to blanks, or click blank then click option'

ASYS_ADMIN

BMKNOD

Cno-new-privileges

Dapparmor=unconfined

Attempts:

3 left

💡 Hint

Common Mistakes

Using apparmor=unconfined disables AppArmor but does not disable new privileges.

Dropping SYS_ADMIN instead of MKNOD.

--cap-add=SYS_ADMIN grants administrative capabilities. --cap-drop=MKNOD removes the ability to create device files. --security-opt=no-new-privileges prevents privilege escalation inside the container.