A Linux capability is a unit of kernel privilege. It lets a process perform selected restricted operations without giving the container unrestricted access to the host kernel. This supports least privilege: grant only the operations an application requires instead of running it as fully privileged. section 2.3.4 section 17.2.1
Common capabilities illustrate how privileges can be limited to a particular job:
- CAP_NET_ADMIN permits network-related operations. section 2.3.4
- CAP_NET_BIND_SERVICE permits binding to port numbers below 1024. section 2.3.4
- CAP_SYS_TIME permits changing the system clock. section 2.3.4
Capabilities differ from a privileged container. Privileged mode bypasses kernel permission checks and gives the process full host-kernel access; capabilities grant only specified privileges. Add or drop capabilities in the container security context, and avoid granting any capability the workload does not need. section 2.3.4 section 17.2.1
Node networking with limited privileges
A pod-networking agent may need network administration and raw-packet access. Its container definition can add NET_RAW and NET_ADMIN while keeping privileged set to false, granting the required subset rather than unrestricted kernel access.
