Docker Docker Security Capabilities Cap DropAdd capdrop capadd privileged Flag Risks

1. Core Command / Concept

This topic allows you to manage capabilities within a Docker container. docker run --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE.

2. Step-by-Step

1. Check the default capabilities of your Docker container: docker run --rm -it --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE alpine /bin/sh -c "getcap -r / 2>/dev/null"
   Output: List of capabilities.
2. ⚠️ This deletes all stopped containers: docker rm $(docker ps -aq)
3. Create a new container with a specific capability: docker run --rm -it --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE alpine /bin/sh -c "getcap -r / 2>/dev/null"
   Output: List of capabilities.
4. Check the capabilities of a running container: docker inspect --format='{{.Config.CapDrop}} {{.Config.CapAdd}}' <container_id>
   Output: List of dropped and added capabilities.
5. Clean up: docker rm $(docker ps -aq)

3. Real Commands with Examples

Example 1: Add a capability

• Purpose: Allow the container to bind to port 80.
• Command: docker run --rm -it --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE alpine /bin/sh -c "getcap -r / 2>/dev/null"
• Brief explanation of flags: --cap-drop ALL drops all capabilities, --cap-add CAP_NET_BIND_SERVICE adds the capability to bind to port 80.

Example 2: Drop a capability

• Purpose: Prevent the container from using the NET_RAW capability.
• Command: docker run --rm -it --cap-drop NET_RAW --cap-add CAP_NET_BIND_SERVICE alpine /bin/sh -c "getcap -r / 2>/dev/null"
• Brief explanation of flags: --cap-drop NET_RAW drops the NET_RAW capability, --cap-add CAP_NET_BIND_SERVICE adds the capability to bind to port 80.

Example 3: Use the --privileged flag

• Purpose: Run the container in privileged mode.
• Command: docker run --rm -it --privileged alpine /bin/sh -c "getcap -r / 2>/dev/null"
• Brief explanation of flags: --privileged allows the container to access all capabilities.

4. Common Errors

Error 1: Unknown capability

• Error message or symptom: docker: Error response from daemon: Unknown capability: CAP_NET_BIND_SERVICE
• Why it happens: The capability is not available in the Docker version.
• One-line fix: docker version to check the available capabilities.

Error 2: Capability not allowed

• Error message or symptom: docker: Error response from daemon: Capability not allowed: CAP_NET_BIND_SERVICE
• Why it happens: The capability is not allowed in the Docker configuration.
• One-line fix: docker run --rm -it --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE alpine /bin/sh -c "getcap -r / 2>/dev/null"

Error 3: Container not running

• Error message or symptom: docker: Error response from daemon: Container not running: <container_id>
• Why it happens: The container is not running.
• One-line fix: docker start <container_id>

5. Quick Checks

Scenario 1: Check if a container has a specific capability

• Situation: You want to check if a container has the NET_BIND_SERVICE capability.
• Command: docker inspect --format='{{.Config.CapDrop}} {{.Config.CapAdd}}' <container_id>
• Correct response: List of dropped and added capabilities, including NET_BIND_SERVICE.

Scenario 2: Check if a container is running with the --privileged flag

• Situation: You want to check if a container is running with the --privileged flag.
• Command: docker inspect --format='{{.Config.Privileged}}' <container_id>
• Correct response: true if the container is running with the --privileged flag, false otherwise.

Scenario 3: Check if a container has the CAP_NET_BIND_SERVICE capability

• Situation: You want to check if a container has the CAP_NET_BIND_SERVICE capability.
• Command: docker inspect --format='{{.Config.CapDrop}} {{.Config.CapAdd}}' <container_id>
• Correct response: List of dropped and added capabilities, including CAP_NET_BIND_SERVICE.

6. Last-Minute Reference

• Docker version: docker version
• Available capabilities: docker run --rm -it --cap-drop ALL --cap-add CAP_NET_BIND_SERVICE alpine /bin/sh -c "getcap -r / 2>/dev/null"
• Container ID: docker ps -aq
• Container name: docker ps -aq --format '{{.Names}}'
• Container image: docker inspect --format='{{.Config.Image}}' <container_id>
• Container configuration: docker inspect --format='{{.Config}}' <container_id>
• Container environment variables: docker inspect --format='{{.Config.Env}}' <container_id>
• Container ports: docker inspect --format='{{.Config.ExposedPorts}}' <container_id>
• Container volumes: docker inspect --format='{{.Mounts}}' <container_id>
• Container network settings: docker inspect --format='{{.NetworkSettings}}' <container_id>
• Container process list: docker exec -it <container_id> ps -ef
• Container logs: docker logs <container_id>
• Container stats: docker stats <container_id>