Container security fundamentals part 3: Capabilities

This post explains Linux capabilities and how they break down root privileges into granular rights that can be applied to processes and files, then shows how Docker and Kubernetes manage these capabilities and related sysctls in container network namespaces. It demonstrates auditing (pscap/filecap), selectively granting capabilities (setcap), and modern defaults that reduce the need for certain capabilities (e.g., ping_group_range and net.ipv4.ip_unprivileged_port_start), concluding with guidance to test containers with cap-drop=ALL and add back only what’s necessary for secure operation.