Secure Your Containers with this One Weird Trick

Did you know there is an option to drop Linux capabilities in Docker? Using the docker run --cap-drop option, you can lock down root in a container so that it has limited access within the container. Sadly, almost no one ever tightens the security on a container or anywhere else. The Day After is Too Late There's an unfortunate tendency in IT to think about security too late. People only buy a sec

[mapk0y]

丁寧。勉強になる

[fcicq]

security related linux capabilities. check with pscap. docker --cap-drop / --add-drop

[mahata777]

“docker run --cap-drop”

[masami256]

dockerの--cap-dropと--add-dropオプションで不要な権限を捨てたり、必要なやつは追加したりと。