How do Linux capabilities, seccomp profiles, AppArmor/SELinux, and Trivy fit into securing containers in production?

Q: How do Linux capabilities, seccomp profiles, AppArmor/SELinux, and Trivy fit into securing containers in production?

> * **Linux Capabilities**: Linux splits root permissions into smaller, distinct capabilities (e.g., `CAP_NET_ADMIN`, `CAP_SYS_ADMIN`). Docker strips all non-essential capabilities from container roots by default. You can drop all capabilities and add only what is needed: `--cap-drop=ALL --cap-add=NET_BIND_SERVICE`. * **seccomp (Secure Computing Mode)**: Filters system calls (syscalls) made by container processes. Docker applies a default seccomp profile that blocks dangerous syscalls (li

💬Answer

Linux Capabilities: Linux splits root permissions into smaller, distinct capabilities (e.g., CAP_NET_ADMIN, CAP_SYS_ADMIN). Docker strips all non-essential capabilities from container roots by default. You can drop all capabilities and add only what is needed: --cap-drop=ALL --cap-add=NET_BIND_SERVICE.
seccomp (Secure Computing Mode): Filters system calls (syscalls) made by container processes. Docker applies a default seccomp profile that blocks dangerous syscalls (like reboot or ptrace).
AppArmor / SELinux: Linux Security Modules that enforce mandatory access controls (MAC) on containers, restricting which files, directories, and ports a container can access on the host.
Trivy: A simple, comprehensive vulnerability scanner for container images. Run Trivy in your CI/CD pipelines (trivy image <image-name>) to detect OS package and dependency vulnerabilities (CVEs) before pushing to production registries.

Apurv Gujjar

DevOps & Cloud Engineer

Specialized in:DevOpsAWSGCPKubernetesTerraformDocker

View Portfolio

Back to all Docker questions

How do Linux capabilities, seccomp profiles, AppArmor/SELinux, and Trivy fit into securing containers in production?

💬Answer

Linux Capabilities: Linux splits root permissions into smaller, distinct capabilities (e.g., CAP_NET_ADMIN, CAP_SYS_ADMIN). Docker strips all non-essential capabilities from container roots by default. You can drop all capabilities and add only what is needed: --cap-drop=ALL --cap-add=NET_BIND_SERVICE.
seccomp (Secure Computing Mode): Filters system calls (syscalls) made by container processes. Docker applies a default seccomp profile that blocks dangerous syscalls (like reboot or ptrace).
AppArmor / SELinux: Linux Security Modules that enforce mandatory access controls (MAC) on containers, restricting which files, directories, and ports a container can access on the host.
Trivy: A simple, comprehensive vulnerability scanner for container images. Run Trivy in your CI/CD pipelines (trivy image <image-name>) to detect OS package and dependency vulnerabilities (CVEs) before pushing to production registries.

Apurv Gujjar

DevOps & Cloud Engineer

Specialized in:DevOpsAWSGCPKubernetesTerraformDocker

View Portfolio

How do Linux capabilities, seccomp profiles, AppArmor/SELinux, and Trivy fit into securing containers in production?

Related Docker Questions

How would you explain the difference between a container and a virtual machine to someone new to DevOps?

What is Docker, and what specific advantages does it bring to the software development lifecycle?

Can you walk me through the low-level container runtime stack (runc, containerd, CRI-O)? What actually happens under the hood when 'docker run' executes?

# Execution flow of `docker run`:

Apurv Gujjar

How do Linux capabilities, seccomp profiles, AppArmor/SELinux, and Trivy fit into securing containers in production?

Related Docker Questions

How would you explain the difference between a container and a virtual machine to someone new to DevOps?

What is Docker, and what specific advantages does it bring to the software development lifecycle?

Can you walk me through the low-level container runtime stack (runc, containerd, CRI-O)? What actually happens under the hood when 'docker run' executes?

# Execution flow of `docker run`:

Apurv Gujjar