3 ms·
You can obviate almost all the issues by running docker with --drop-cap all to drop all capabilities. You still share the uid, but with the default seccomp poli
by justincormack 11y ago
You can obviate almost all the issues by running docker with --drop-cap all to drop all capabilities. You still share the uid, but with the default seccomp policy blocking ptrace as well it is pretty secure. Obviously running as a user as well is better.