Metadata

Id: dockercompose-container-capabilities-unrestricted

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Granting containers high-risk Linux capabilities such as SYS_ADMIN, NET_ADMIN, BPF, or ALL expands the attack surface by allowing container processes to interact with privileged kernel interfaces, load kernel modules, or gain full root-equivalent access to the host. A compromised container with these capabilities can escape isolation and affect the entire host. The cap_add list should not include ALL, BPF, DAC_READ_SEARCH, NET_ADMIN, SYS_ADMIN, SYS_MODULE, or SYS_PTRACE unless explicitly required and documented.

Compliant Code Examples

services:
  benign:
    image: alpine
    cap_add: [CHOWN, SETUID]
  no_drop_all:
    image: alpine
  dropped:
    image: alpine
    cap_drop: [ALL]

Non-Compliant Code Examples

services:
  all_caps:
    image: alpine
    cap_add: [ALL]
  admin_caps:
    image: alpine
    cap_add:
      - SYS_ADMIN
      - CHOWN
  ebpf:
    image: alpine
    cap_add: [BPF]
  prefixed_admin:
    image: alpine
    cap_add: [CAP_SYS_ADMIN]