title: Why is requiring that all capabilities be dropped in a Kubernetes PodSecurityPolicy redundant with non-root + disallow privilege escalation?
body: <p>The second example policy from the <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#example-policies" rel="nofollow noreferrer">PodSecurityPolicy documentation</a> consists of the following PodSecurityPolicy snippet</p>
  
  <pre><code>...
  spec:
    privileged: false
    # Required to prevent escalations to root.
    allowPrivilegeEscalation: false
    # This is redundant with non-root + disallow privilege escalation,
    # but we can provide it for defense in depth.
    requiredDropCapabilities:
      - ALL
  ...
  </code></pre>
  
  <p>Why is dropping all capabilities redundant for non-root + disallow privilege escalation? You can have a container process without privilege escalation that is non-root but has effective capabilities right?</p>
  
  <p>It seems like this is not possible with Docker:</p>
  
  <pre><code>$ docker run --cap-add SYS_ADMIN --user 1000 ubuntu grep Cap /proc/self/status
  CapInh: 00000000a82425fb
  CapPrm: 0000000000000000
  CapEff: 0000000000000000
  CapBnd: 00000000a82425fb
  CapAmb: 0000000000000000
  </code></pre>
  
  <p>All effective capabilities have been dropped even when trying to explicitly add them. But other container runtimes could implement it, so is this comment just Docker specific?</p>