CKAD — Linux Capabilities & Non-Root

less than 1 minute read

Linux Capabilities

Linux capabilities break root privileges into smaller units. Instead of giving a container full root access, you can add specific capabilities.

Capability	Description
`NET_BIND_SERVICE`	Bind to ports below 1024
`SYS_TIME`	Set the system clock
`CHOWN`	Change file ownership
`DAC_OVERRIDE`	Bypass file permission checks
`NET_ADMIN`	Network administration (iptables, routing)
`SYS_PTRACE`	Trace processes (debugging)

securityContext:
  capabilities:
    drop:
    - ALL
    add:
    - NET_BIND_SERVICE
    - CHOWN

# Check what capabilities a running container has
kubectl exec secure-pod -- cat /proc/1/status | grep Cap

Running containers as root is a security risk. Here is how to ensure your containers run as non-root:

FROM nginx:1.27-alpine
RUN adduser -D -u 1000 appuser
USER 1000

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

If the container image specifies USER root and the Pod has runAsNonRoot: true, the container will fail to start with:

Error: container has runAsNonRoot and image will run as root