Answer
Docker drops powerful capabilities like SYS_ADMIN to limit root power.
Quick Answer
Linux capabilities break root's monolithic power into granular permissions: CAP_NET_ADMIN (network config), CAP_SYS_PTRACE (process tracing), CAP_CHOWN (file ownership). Docker drops most capabilities by default and adds only a safe minimal set. --cap-add and --cap-drop let you tune exactly what a container can do.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ