Dropping Unneeded Privileges
Linux capabilities split some traditionally powerful root privileges into individual permissions. Containers can drop capabilities they do not need and selectively add back a required capability.
Start with a minimal capability set rather than granting broad privileges such as --privileged.
ADVERTISEMENT