CAP_SYS_ADMIN

Q: How deeply does Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more cover CAP_SYS_ADMIN?

Explains broad administrative scope, mount control, container defaults, and isolation effects without enumerating every operation.

As explained in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

CAP_SYS_ADMIN is a Linux capability that includes permission to perform filesystem mounts and many other system-administration operations.

CAP_SYS_ADMIN is a broad Linux capability that permits filesystem mounts and unmounts, among many other system-administration operations. Podman drops it from containers by default, so even root processes cannot remount read-only mount points. section 10.2.2 section 10.7

Rootful Podman running inside a container needs CAP_SYS_ADMIN to mount filesystems; --privileged supplies it. Rootless Podman instead uses CAP_SETUID and CAP_SETGID, which can support a narrower configuration. section 8.4.1 section 8.4.2

Run nested rootful Podman

podman run --privileged quay.io/podman/stable podman version demonstrates a nested Podman invocation that requires filesystem-mount permission. section 8.4.1

How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it

Cover of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

liveBook manning.com

Read Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more on liveBook Get the book at manning.com

Related concepts

Linux capabilitykind of · A Linux capability is a discrete kernel permission that divides traditionally privileged operations into independently controllable units.
privileged containerused by · A privileged container is a container granted broad host-level permissions or capabilities that substantially reduce its normal isolation from the host.
rootful modeused by · Rootful mode is a container-execution mode in which container management and processes operate with host-level root privileges.
mount pointuses · A mount point is a filesystem path where a storage device, volume, or filesystem is attached and made accessible within a directory hierarchy.
rootless modecontrasts with · Rootless mode is a container-execution mode in which the container engine and processes run without host-level root privileges.
mount namespaceconfigured by · A mount namespace is a Linux namespace that isolates the filesystem mount points visible to processes.

This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.