A Linux capability is a discrete permission that divides the privileges traditionally associated with root into independently enabled or disabled units. Capabilities are attributes of each thread, so a process can retain selected powers without receiving unrestricted kernel access. section 10.2 section 1.2
Podman uses capabilities to limit root inside a container. Its default profile removes 30 of 41 capabilities, leaving root substantially less powerful than root on the host. The remaining permissions support tasks such as changing UIDs and GIDs, changing process identity, and binding to ports below 1024. section 10.2.1
Inspect and adjust container capabilities
Inspect the default profile with `podman run --rm ubi8 capsh --print`. Remove a permission with `--cap-drop CAP_NET_BIND_SERVICE`; remove every capability with `--cap-drop=all`. If an application needs raw network packets, grant only `CAP_NET_RAW`, preferably together with `--cap-drop=all`: `podman run --cap-drop=all --cap-add CAP_NET_RAW ubi8 capsh --print`. section 10.2.1 section 10.2.3 section 10.2.4
Treat capability changes as targeted security exceptions, not as a reason to use `--privileged`. Podman combines dropped capabilities with namespaces, SELinux, seccomp, read-only kernel filesystems, and user namespaces, forcing a compromised container through multiple defensive boundaries. section 11.5.1 section 10.0
Listing 10.3 The default list of capabilities available within a Podman container
$ podman run --rm ubi8 capsh --print Current: = #1 cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid, cap_setuid,cap_setpcap,cap_net_bind_service,cap_sys_chroot, cap_setfcap+eip Bounding set = #2 cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid, cap_setuid,cap_setpcap,cap_net_bind_service,cap_sys_chroot,cap_setfcap ... uid=0(root) #3 gid=0(root) groups=
View the default capabilities and bounding set available to root inside a Podman container. section 10.2.1
$ podman run --cap-drop=all --cap-add CAP_NET_RAW ubi8 capsh --print Current: = cap_net_raw+eip Bounding set =cap_net_raw ...
Compare a container with every capability dropped against one granted only CAP_NET_RAW. section 10.2.4
