Merge pull request #5810 from vmarmol/drop-caps

Change libcontainer to drop all capabilities by default.
2026-10-04 07:48:44 +00:00 · 2014-05-16 11:51:41 -07:00
parent 23062e55fd 9d6875d19d
commit 01d10d6f13
3 changed files with 30 additions and 18 deletions
@@ -26,6 +26,11 @@ func New() *libcontainer.Container {
 			"NET_ADMIN":      false,
 			"MKNOD":          true,
 			"SYSLOG":         false,
+			"SETUID":         true,
+			"SETGID":         true,
+			"CHOWN":          true,
+			"NET_RAW":        true,
+			"DAC_OVERRIDE":   true,
 		},
 		Namespaces: map[string]bool{
 			"NEWNS":  true,