13

The docker compose file reference describes the cap_add and cap_drop elements in a rather terse fashion:

Add or drop container capabilities. See man 7 capabilities for a full list.

Do these elements have an order, that is, add first, then drop? Or does the order matter (is this supported in YAML at all for dictionaries?)?

What happens when one of cap_add or cap_drop contains ALL?

I'm aware of the Docker Linux default set of capabilities, defined in https://github.com/moby/moby/blob/master/oci/caps/defaults.go#L4.

TheDiveO
  • 2,183
  • 2
  • 19
  • 38

1 Answers1

27

After diving around the moby source code, I finally located TweakCapabilities(): it takes the two sets of capabilities to add and to drop, enforcing the following scheme below; thus works in docker-compose.yaml where YAML doesn't define an order for the cap_add and cap_drop keys. The first matching item below will terminate the list.

  • container is privileged: true: ignore cap_add and cap_drop completely, return all available capabilities instead.
  • both cap_add and cap_drop are empty: return the default Docker set of capabilities.
  • cap_add contains ALL: return all capabilities minus the capabilities listed in cap_drop (ignores ALL in the latter).
  • cap_drop contains ALL: return the capabilities from cap_add only, ignoring any Docker default capabilities.
  • default: first drop all capabilites from the default set listed in cap_drop, then add the capabilities in cap_add, and finally return the result.

If I'm not mistaken this can be also represented in a more accessible manner as follows...

cap_add/cap_drop

privileged: true
ALL capabilities: ignores cap_add and cap_drop (boss mode)
no cap_add cap_add: ['CAP_A'] cap_add: ['ALL']
no cap_drop default capabilities default + CAP_A ALL capabilities
cap_drop: ['CAP_Z'] default -CAP_Z default -CAP_Z +CAP_A ALL -CAP_Z
cap_drop: ['ALL'] NO capabilities CAP_A ALL capabilities

In the end, there's only the following two "deterministic" combinations that always include cap_drop: ALL and that follow the line of least privilege:

cap-drop

no cap_add cap_add: ['CAP_A']
 
 
cap_drop: ['ALL'] NO capabilities CAP_A
TheDiveO
  • 2,183
  • 2
  • 19
  • 38
  • Thanks for the anwser. Just one comment. It is a good practice to share the permanent link for TweakCapabilities() to avoid pointing to the wrong place: https://github.com/moby/moby/blob/ad9d70b0e6833b746eecccc08a17459ba8bb31c4/oci/caps/utils.go#L83 – nav Mar 08 '23 at 18:49
  • somehow I got the wrong link, but that's fixed now; of course, this should have been a perma link right from the beginning. – TheDiveO Mar 10 '23 at 14:29