The article contains the best explanation of Linux capabilities that I have seen. Too bad that Docker and other container solutions defaults to rather broad se

The article contains the best explanation of Linux capabilities that I have seen. Too bad that Docker and other container solutions defaults to rather broad set of capabilities requiring to use things like --cap-drop=ALL --cap-add=NET_BIND_SERVICE ... with typical container invocations to minimize a chance of container escape.