I'm not a docker user, but I think on binaries I can always use still capabilities, to limit what they can do. I suppose most of them will be needed in this ca

I'm not a docker user, but I think on binaries I can always use still capabilities, to limit what they can do. I suppose most of them will be needed in this case, and it's still a concern. Just did want to remember to people about linux capabilities after read your comment: man -k cap | grep capabilities