3 ms·
No, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the conta
by dohqu8Zi 9y ago
No, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the container.
- dohqu8Zi 9y agoBTW: Depending on the configuration you can create a new namespace within Docker to gain CAP_NET_RAW since namespaces can nest.
- wrongmmmm 9y agoNot true. CAP_NET_RAW is on by default: https://github.com/moby/moby/blob/master/oci/defaults_linux.go#L62-L77 https://github.com/moby/moby/blob/master/oci/defaults_linux.... Otherwise no one could ping from a container.
- dohqu8Zi 9y agoThanks for the correction.