> Markdown version of [/videos/718-turning-container-security-up-to-11-with-capabilities?t=201](https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities?t=201). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Turning Container security up to 11 with Capabilities

Are default container permissions exposing your internal traffic to rogue images? Discover why dropping all Linux kernel capabilities is the ultimate way to shrink your blast radius.

- **Speakers:** Mathias Tausig
- **Event:** World Congress 2023
- **Published:** September 27, 2023
- **Duration:** 28:47
- **URL:** https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities

## Summary

Unencrypted HTTP communication between isolated containers on a single host represents a critical, often overlooked vulnerability. A compromised or malicious container image—such as a seemingly innocuous sidecar or health check container pulled from a public registry—can launch a localized man-in-the-middle attack. By leveraging standard network tools, an attacker can execute ARP spoofing to silently intercept and sniff plaintext traffic passing between backend and frontend services running on the same infrastructure.

The root cause of this exposure lies in how container runtimes manage kernel permissions. While traditional Unix access control relies on an all-or-nothing root model, Linux kernel capabilities slice administrative powers into granular, distinct privileges. However, Docker and other runtimes assign a relatively generous default list of capabilities to standard containers. It is precisely this default access—specifically permissions like network raw packet creation—that allows a rogue container to forge network packets, bypass standard TCP/IP isolation, and compromise adjacent workloads.

To effectively secure containerized environments, engineering teams must embrace a defense-in-depth strategy anchored in the principle of least privilege. Rather than relying on default settings or blocking specific privileges, administrators should adopt a strict allow-list methodology. By dropping all capabilities globally in Docker Compose or Kubernetes security contexts and systematically adding back only what the application explicitly requires, operations teams can significantly harden their deployments. While determining exact capability requirements often involves pragmatic trial and error, stripping away excess privileges drastically shrinks the blast radius of any exploit, ensuring that even if an attacker gains code execution, their lateral movement remains severely restricted.

**Keywords:** container security assessments, linux kernel capabilities, docker container isolation, local man-in-the-middle attacks, arp spoofing mitigation, unencrypted network traffic, malicious container images, principle of least privilege, kubernetes security context, defense in depth strategy, reducing exploit blast radius, docker compose capability drops, granular administrative privileges, cap_net_raw vulnerabilities, sidecar container hijacking

## Chapters

1. **Identifying single-host container network vulnerabilities** (00:04) — Unencrypted HTTP traffic between isolated containers creates potential attack vectors on a local host.
1. **Building a proof of concept container deployment** (03:21) — Docker Compose establishes a frontend and backend architecture with an auxiliary health check.
1. **Executing a containerized man-in-the-middle attack** (06:19) — A malicious image sniffs unencrypted communication between containers running on the same host.
1. **Moving from all-or-nothing root access to capabilities** (09:34) — Linux kernel capabilities split administrative privileges into targeted categories for granular access control.
1. **Managing file and process permissions with capability boundaries** (14:14) — Command line tools like filecap and pscap inspect and manage granular process permissions across the system.
1. **Evaluating default capabilities assigned by Docker runtimes** (18:02) — Analyzing the extensive list of permissions granted to standard containers reveals the danger of using privileged modes.
1. **Enforcing container security with capability allow-list approaches** (19:42) — Dropping all default capabilities and appending only essential ones enforces the principle of least privilege.
1. **Finding essential application capabilities through trial and error** (21:24) — Testing container execution failures accurately identifies required permissions like chown and setuid.
1. **Blocking container spoofing attacks by removing raw network access** (24:34) — Dropping the raw network capability successfully prevents ARP spoofing and malicious container sniffing.
1. **Applying capability constraints in Kubernetes pod specifications** (25:18) — Configuring security contexts in Kubernetes limits the blast radius during an exploit to enforce defense in depth.
1. **Discussing sidecar attacks and transport layer security limitations** (27:12) — Unencrypted traffic handled by sidecar containers introduces security gaps between standard components and mesh proxies.

## Related Moments

- [Identifying software vulnerabilities and typical configuration weaknesses](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Discussing container privilege escalation and volume security risks](https://www.wearedevelopers.com/videos/488-hacking-kubernetes-live-demo-marathon) (from "Hacking Kubernetes: Live Demo Marathon")
- [Applying tactical security configurations to Docker container layers](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) (from "A practical guide to writing secure Dockerfiles")
- [Restricting container privileges using capability and seccomp profiles](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Handling container constraints and fileless malware](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) (from "Enhancing Workload Security in Kubernetes")
- [Live demonstration of vulnerability exploitation and zero trust mitigation](https://www.wearedevelopers.com/videos/100089-trust-issues-because-zero-trust-isn-t-optional-anymore) (from "Trust Issues: Because Zero-Trust Isn’t Optional Anymore")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Building AI Solutions with Rust and Docker](https://www.wearedevelopers.com/magazine/494-building-ai-solutions-with-rust-and-docker)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [IT System Administrator](https://www.wearedevelopers.com/jobs/48290-it-system-administrator) at **Sensory-Minds GmbH**
- [Platform Engineer (DevOps)](https://www.wearedevelopers.com/jobs/48264-platform-engineer-devops) at **WDW Consulting GmbH**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group**