I need to add the SYS_ADMIN capability to container so that able to bind mount within container. But I have security concerns (please refers to https://lwn.net/Articles/486306/ and https://rhelblog.redhat.com/2016/11/30/container-tidbits-adding-capabilities-to-a-container/).
If there is actual example about side effects of adding the SYS_ADMIN capability to container? Another question is, I have heard one can break out from container which has SYS_ADMIN capability to host. But how to achieve it?
Thanks a lot.


Note that giving a process SYS_ADMIN capability is pretty close to removing all isolation from it. As a rule, you shouldn’t do this, but it’s helpful to know that you can if you absolutely need to for some reason.

Also, using the --cap-add=SYS_ADMIN command grants a smaller subset of capabilities to the container, compared to the --privileged switch, so it’s better to use whenever possible. Try using --cap-add and see if that provides the access you need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.