Linux Capabilities

Restrict Linux capabilities to the minimum set required by each container. The default approach is to drop all capabilities and selectively add only those the workload needs.

Default: Drop All Capabilities

Every container should drop all Linux capabilities unless specific ones are required:

securityContext:
  capabilities:
    drop: ["ALL"]

At minimum, containers must drop MKNOD, SETUID, SETGID, and KILL. Dropping ALL is preferred as it is simpler and more restrictive.

Dangerous Capabilities

The following capabilities are restricted by the certsuite and should not be added unless the workload has a documented exception.