<p>Linux capabilities is applied to an executable. If I add capabilities to a container, what does it mean?
This is my container securityContext:</p>
<pre><code>securityContext:
  runAsUser: 1008
  capabilities:
    add:
      - NET_ADMIN
      - NET_RAW
</code></pre>
<p>But my task can't create raw socket. So shall I apply capabilities to the executable when packing docker image?</p>

<p>As I have adviced you in comment section, I am posting it as an answer:</p>
<blockquote>
<p>Starting with kernel 2.2, Linux has divided privileged processes’
privileges into distinct units, known as capabilities. These distinct
units/privileges can be independently assigned and enabled for
unprivileged processes introducing root privileges to them. Kubernetes
users can use Linux capabilities to grant certain privileges to a
process without giving it all privileges of the root user. This is
helpful for improving container isolation from the host since
containers no longer need to write as root — you can just grant
certain root privileges to them and that’s it.</p>
</blockquote>
<p>See: <a href="https://medium.com/kubernetes-tutorials/defining-privileges-and-access-control-settings-for-pods-and-containers-in-kubernetes-2cef08fc62b7" rel="nofollow noreferrer">linux-cap-kubernetes</a>.</p>
<p>Part of your code under container section should look like this:</p>
<pre><code>securityContext:  
  capabilities:  
    add:
      - NET_ADMIN
      - NET_RAW
</code></pre>
<p>To run some capabilities (in your case perform various network-related operations) you have to run container as root. See example: <a href="https://stackoverflow.com/questions/61616892/sys-time-capability-now-working-in-kubernetes">capabilities-securitycontext</a>.</p>
<p>Read more: <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities" rel="nofollow noreferrer">linux-capabilities-securityContext</a>.</p>
