<p>I am running a code which opens a raw socket inside a docker container with kubernetes as the orchestrator.</p>
<p>Following is my sample code:</p>
<pre><code>#include &lt;stdio.h&gt;  
#include &lt;sys/socket.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;errno.h&gt;
#include &lt;netinet/tcp.h&gt;
#include &lt;netinet/ip.h&gt;
#include &lt;arpa/inet.h&gt;
#include &lt;unistd.h&gt;

int main (void)
{  
        //Create a raw socket
        int s = socket (AF_INET, SOCK_RAW, IPPROTO_SCTP);

        if(s == -1)
        {
                perror(&quot;Failed to create socket&quot;);
                exit(1);
        }

}
</code></pre>
<p>On running the code as a non-root user in my container/pod, I got this error.</p>
<pre><code>./rawSocTest
Failed to create socket: Operation not permitted
</code></pre>
<p>This is obvious as it requires root level privileges to open a raw socket. This I corrected by setting capability cap_net_raw.</p>
<pre><code>getcap rawSocTest
rawSocTest = cap_net_raw+eip
</code></pre>
<p>Now when I run it again. I am getting a different error.</p>
<pre><code>./rawSocTest
bash: ./rawSocTest: Permission denied
</code></pre>
<p>As per my understanding, setting the capability should have fixed my issue. Am I missing something here? or Is this a known limitation of container?</p>
<p>Thanks in advance.</p>

Shighil
<p>I ran it using user kubernetes-admin</p>
<p>Adding the sample deployment file for container definition to what was stated earlier</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpd-deployment
  labels:
    app: httpd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpd
  template:
    metadata:
      labels:
        app: httpd
    spec:
      containers:
      - name: my-apache2
        image: docker.io/arunsippy12/my-apache2:latest
        securityContext:
         allowPrivilegeEscalation: true
         capabilities:
          add: [&quot;NET_RAW&quot;]
        ports:
        - containerPort: 80
</code></pre>
<p>Also u can refer the k8s documentation:
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/</a></p>
