Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory?
Solution. capabilities
Capabilities are not a Linux kernel facility that limit a Docker container's access to host resources, such as CPU or memory. Capabilities are a Linux kernel feature that divide the privileges of the root user into distinct units, called capabilities, which can be independently enabled or disabled for each process. Capabilities allow fine-grained control over the operations that a process can perform on the system, such as binding to a privileged port, changing the system time, loading kernel modules, etc. Docker uses capabilities to restrict the default set of capabilities available to the root user inside a container, following the principle of least privilege. However, capabilities do not affect how much CPU or memory a container can use on the host system. Reference: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities, https://man7.org/linux/man-pages/man7/capabilities.7.html
Limited Time Offer
25%
Off
Currently there are no comments in this discussion, be the first to comment!
Currently there are no comments in this discussion, be the first to comment!