Are you Avoiding --privileged? (Q3)
summary
Demo shows --privileged turns on Linux capabilities and mounts all host devices, equivalent to adding every capability so a compromised container can load kernel modules or reformat host disks. Docker’s default gives a smaller sensible capability set and most apps need far fewer capabilities than assigned. Containers run as root inside container by default, so not using --privileged matters more than just avoiding a "root" label.
AI-written summary · about
chapters (4)
related talks
24mChecking Your --privileged Container
33mContainers Security Layers and How Not to Break them
38mEverything you don't want to know about privileged containers
50mInsights in Container Security
22mHardening Docker Daemon with Rootless Mode
26mContainers: Your Ally in Improving Security
35mThe Reality of Rootless Containers
14mcontainerd: Rootless Containers 2020