<p>i have a question and a problem about capabilities.</p>

<p>Why my program work when i run <code>docker run --cap-add=NET_ADMIN ...</code> ?</p>

<p>And it's doesn't work if i run my program with file .yml which is:</p>

<pre><code>      containers:
      - name: snake
        image: docker.io/kelysa/snake:lastest
        imagePullPolicy: Always
        securityContext:
          privileged: true
          capabilities:
            add: ["NET_ADMIN","NET_RAW"]
</code></pre>

<p>What is the difference between run docker with --cap-add and run a pod with the same capabilities ? </p>

<p>As described by <a href="https://stackoverflow.com/questions/58377469/difference-between-cap-add-net-admin-and-add-capabilities-in-yml#">David Maze</a> and  According to the docker <a href="https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities" rel="noreferrer">docs:Runtime privilege and Linux capabilities</a> </p>

<blockquote>
  <p>By default, Docker containers are “unprivileged” and cannot, for example, run a Docker daemon inside a Docker container. This is because by default a container is not allowed to access any devices, but a “privileged” container is given access to all devices (see the documentation on cgroups devices).</p>

<pre><code>--cap-add: Add Linux capabilities,
--cap-drop: Drop Linux capabilities,
--privileged=false: Give extended privileges to this container
--device=[]: Allows you to run devices inside the container without the --privileged flag.
</code></pre>
  
  <p>When the operator executes <code>docker run --privileged</code>, Docker will enable access to all devices on the host as well as set some configuration in AppArmor or SELinux to allow the container nearly all the same access to the host as processes running outside containers on the host. </p>
  
  <p>In addition to --privileged, the operator can have fine grain control over the capabilities using --cap-add and --cap-drop. </p>
</blockquote>

<p>You can find there two kinds of capabilities:</p>

<ul>
<li>Docker with default list of capabilities that are kept.</li>
<li>capabilities which are not granted by default and may be added.</li>
</ul>

<p>This command <code>docker run --cap-add=NET_ADMIN</code> will apply additional linux capibilities.</p>

<p>As per docs:</p>

<blockquote>
  <p>For interacting with the network stack, instead of using --privileged they should use --cap-add=NET_ADMIN to modify the network interfaces.</p>
</blockquote>

<p><strong>Note</strong>:</p>

<p>To reduce syscall attacks it's good practice to give the container only required privileges.  Please refer also to <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="noreferrer">Enabling Pod Security Policies</a>.</p>

<p>From container it can be achieved by using:</p>

<pre><code>securityContext:
  capabilities:
    drop: ["all"]
    add: ["NET_BIND"]
</code></pre>

<p>To see applied capibilities inside your container you can use:
 <code>getpcaps process_id or $(pgrep your-proces_name)</code> to list and explore linux capibilities you an use <code>capsh --print</code></p>

<p><strong>Resources</strong>:</p>

<ul>
<li><a href="https://linux-audit.com/linux-capabilities-101/" rel="noreferrer">Linux capibilities</a>, </li>
<li><a href="https://github.com/docker/labs/tree/master/security/capabilities" rel="noreferrer">docker labs</a>,  </li>
<li><a href="http://man7.org/linux/man-pages/man1/capsh.1.html" rel="noreferrer">capsh</a> </li>
<li><a href="https://www.weave.works/blog/container-capabilities-kubernetes/" rel="noreferrer">Configuring Container Capabilities with Kubernetes</a> </li>
<li><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#what-is-a-pod-security-policy" rel="noreferrer">What is a Pod Security Policy</a></li>
</ul>

<p>Hope this help.</p>
