erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-10-28 00:37:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Merge pull request #25348 from giuseppe/warn-about-using-capabilities

Browse source 
docs: warn about adding capabilities
This commit is contained in:
openshift-merge-bot[bot] 2025-02-18 16:18:43 +00:00 • committed by GitHub
commit aafc3739fb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
docs/source/markdown/options/cap-add.md
View file

@ -5,3 +5,15 @@
#### **--cap-add**=*capability*
Add Linux capabilities.
Granting additional capabilities increases the privileges of the
processes running inside the container and potentially allow it to
break out of confinement. Capabilities like `CAP_SYS_ADMIN`,
`CAP_SYS_PTRACE`, `CAP_MKNOD` and `CAP_SYS_MODULE` are particularly
dangerous when they are not used within a user namespace. Please
refer to **user_namespaces(7)** for a more detailed explanation of the
interaction between user namespaces and capabilities.
Before adding any capability, review its security implications and
ensure it is really necessary for the container’s functionality. See
**capabilities(7)** for more information.