Linux capability
A Linux capability is a discrete kernel permission that divides traditionally privileged operations into independently controllable units.
Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
A Linux capability is a discrete permission that divides traditionally privileged root powers into independently controllable units.
- How it is used
- Uses capabilities to constrain containerized root and avoid disabling all security separation with privileged mode.
- How deep it goes
- Explains root subdivision, Podman’s default profile, capability inspection, and targeted additions or removals without detailing kernel implementation.
- Examples
- Demonstrates capsh inspection, dropping CAP_NET_BIND_SERVICE or all capabilities, and restoring only CAP_NET_RAW.
- What you can do after
- Operate Podman containers with narrower privileges by inspecting, dropping, and selectively adding capabilities.
Kubernetes in Action, Second Edition
A Linux capability is a fine-grained kernel privilege that grants a process permission to perform selected operations otherwise restricted by kernel checks.
- How it is used
- Strengthens container isolation by granting workloads only the kernel privileges required for their operations.
- How deep it goes
- Explains capability purpose, examples, configuration, and its security distinction from privileged mode, without detailing kernel internals.
- Examples
- Uses CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_SYS_TIME, kube-proxy, and kindnet as concrete examples.
- What you can do after
- Operate/configure containers by adding or dropping capabilities and choosing them instead of unrestricted privileged mode.
Read how Kubernetes in Action, Second Edition explains Linux capability →
Related concepts
- CAP_SYS_ADMINincludes · CAP_SYS_ADMIN is a Linux capability that includes permission to perform filesystem mounts and many other system-administration operations.
- rootcontrasts with · A root or superuser is a privileged account or principal with broad administrative authority that can bypass ordinary permission restrictions within a system.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.