2 ms·
Yes, that's true. But then you might have bigger issues I would say. But agreed. It's a good reason to make sure it's all closed off.
by anonzzzies 3y ago
Yes, that's true. But then you might have bigger issues I would say. But agreed. It's a good reason to make sure it's all closed off.
- nyrikki 3y agoLook at the default capabilities below, as a poster above mentioned NET_RAW and MKNOD are enabled by default. https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities https://docs.docker.com/engine/reference/run/#runtime-privil... Unless you perfectly drop all privileges from every pod you are open to attack. Containers are not security contexts, they are namespaces, that require all actors that can launch a VM to actively drop privileges. This is an intentional design decision and not a bug.