A security team wants a containerized helper process to run with the fewest privileges needed. Which capability strategy best matches Docker security guidance?

Question

Accepted Answer

C. Drop all capabilities and add back only those explicitly required. Docker security guidance recommends removing capabilities that are not needed and granting only the minimal set required. Starting from a dropped set and adding back specific capabilities is a least-privilege approach. Using `--privileged` does the opposite by granting broad access.

A security team wants a containerized helper process to run with the fewest privileges needed. Which capability strategy best matches Docker security guidance?

Related Questions

Discussion