In this lesson, you will learn how to harden your containers by stripping away unnecessary Linux kernel privileges to minimize the potential blast radius of a security breach.
Understanding Kernel Capabilities
By default, the Linux kernel grants processes a wide range of "capabilities" that allow them to perform privileged operations, such as changing file ownership, binding to low-numbered network ports, or modifying system clocks. While your application might be a simple web server, the container engine grants it many of these powers "just in case."
In the security world, this is a violation of the Principle of Least Privilege. If an attacker gains remote code execution within your container, having extra kernel capabilities makes it significantly easier for them to perform a container breakout or escalate privileges to the host.
Dropping Capabilities in Kubernetes
To improve your security posture, you should explicitly drop all default capabilities and only add back the ones strictly required by your application. You do this within the securityContext of your Pod specification.
Consider this example where we secure a standard application:
apiVersion: v1
kind: Pod
metadata:
name: hardened-pod
spec:
containers:
- name: app
image: my-app:latest
securityContext:
capabilities:
drop:
- ALL # Drop every default capability
add:
- NET_BIND_SERVICE # Only add back what is strictly necessary
In this configuration, we start by setting drop: ["ALL"]. This removes all dangerous privileges like CAP_SYS_ADMIN or CAP_CHOWN. We then use the add field to selectively permit only the NET_BIND_SERVICE capability, which allows the process to bind to ports below 1024.
By taking this approach, even if an attacker manages to compromise the application process, they are effectively "caged." They lack the kernel-level permissions required to manipulate the host or perform sophisticated privilege escalation attacks. This proactive "deny-all" approach is a fundamental pillar of securing containerized workloads in production.
Key Takeaway: Always drop all default Linux kernel capabilities and explicitly add back only the specific privileges your application requires to function.