Q: Your security team conducted a penetration test and proved that default Docker containers retain 14 Linux capabilities, including `CAP_NET_RAW` (allowing ARP spoofing and packet sniffing) and `CAP_MKNOD` (allowing creation of device nodes). The CISO mandates that all production containers must drop ALL default capabilities by default, running as unprivileged users. However, your frontend Nginx proxy needs to bind to privileged port 80 and port 443 without running as root. You must configure granular capability hardening.

By default, Docker grants containers a subset of Linux capabilities: `CAP_CHOWN`, `CAP_DAC_OVERRIDE`, `CAP_FOWNER`, `CAP_FSETID`, `CAP_KILL`, `CAP_SETGID`, `CAP_SETUID`, `CAP_SETPCAP`, `CAP_NET_BIND_SERVICE`, `CAP_NET_RAW`, `CAP_SYS_CHROOT`, `CAP_MKNOD`, `CAP_AUDIT_WRITE`, `CAP_SETFCAP`. Many of these can be abused during container breakout attempts.

# Inspect granted capabilities of a default container
docker run --rm alpine capsh --print | grep Current
# Output: Current: = cap_chown,cap_dac_override,cap_net_raw,...

Always strip all capabilities first using `--cap-drop=ALL`. This establishes a zero-capability baseline, preventing unauthorized raw socket creation or ownership changes.

# Strip all capabilities
docker run --rm --cap-drop=ALL alpine capsh --print | grep Current
# Output: Current: = (empty, zero capabilities!)

Linux kernels require the `CAP_NET_BIND_SERVICE` capability to bind to privileged ports below 1024 (e.g., 80, 443). Grant strictly this single capability to an unprivileged container user.

# Run unprivileged container with only CAP_NET_BIND_SERVICE
docker run -d \
  --name secure-nginx \
  --user 1001:1001 \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  -p 80:80 \
  nginxinc/nginx-unprivileged:alpine

Apply the capability dropping and addition declaratively in `compose.yaml` and Kubernetes Pod `securityContext`.

# Docker Compose
services:
  web:
    image: nginxinc/nginx-unprivileged:alpine
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

# Kubernetes Pod SecurityContext
# securityContext:
#   capabilities:
#     drop: ["ALL"]
#     add: ["NET_BIND_SERVICE"]