Docker and CI/CD · Senior · Question 5 of 75
What does --cap-drop ALL --cap-add NET_BIND_SERVICE do?
- ✓Correct answer: Removes all root privileges except binding to low ports
- 2Blocks all network traffic except HTTP on port 80
- 3Drops all CPU limits but keeps the network limits
Explanation
Linux splits root's power into capabilities. Docker already drops many; dropping all and adding back only what's needed shrinks the damage a compromised process can do.