Answer
Misconfigured capabilities like CAP_NET_ADMIN allow route manipulation or packet sniffing.
Quick Answer
Docker uses separate network namespaces per container, but they share the host kernel's networking stack. Vulnerabilities in the host kernel's network code (iptables, VXLAN driver) can cross namespace boundaries. VXLAN traffic is unencrypted by default — an attacker on the same L2 network can sniff overlay traffic between containers.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ