Skip to content
Advertisement

Difference between `–privileged` and `–cap-add=all` in docker

Background: I am running a docker container which needs to load/remove a kernel module which makes USB devices attached to a remote server available on the host which I then want to make available in the container.

It works when running the container with —-privileged and bind mounts for /lib/modules and /dev.

Now I want to remove privileged mode and just allow the minimum necessary access. I tried —-cap-add=all as a start, but that doesn’t seem enough. What else does —-privileged allow?

Advertisement

Answer

Setting privileged should modify:

  • capabilities: removing any capability restrictions
  • devices: the host devices will be visible
  • seccomp: removing restrictions on allowed syscalls
  • apparmor/selinux: policies aren’t applied
  • cgroups: I don’t believe the container is limited within a cgroup

That’s from memory, I might be able to find some more digging in the code if this doesn’t point you too your issue.

User contributions licensed under: CC BY-SA
3 People found this is helpful
Advertisement