共計 3931 個字符，預計需要花費 10 分鐘才能閱讀完成。
這篇文章主要講解了“怎么給容器添加 linux Capabilities”，文中的講解內容簡單清晰，易于學習與理解，下面請大家跟著丸趣 TV 小編的思路慢慢深入，一起來研究和學習“怎么給容器添加 linux Capabilities”吧！
Docker Container Capabilities
在 docker run 命令中，我們可以通過 –cap-add 和 –cap-drop 來給容器添加 linux Capabilities。下面表格中的列出的 Capabilities 是 docker 默認給容器添加的，用戶可以通過 –cap-drop 去除其中一個或者多個。
Docker’s capabilitiesLinux capabilitiesCapability DescriptionSETPCAPCAP_SETPCAPModify process capabilities.MKNODCAP_MKNODCreate special files using mknod(2).AUDIT_WRITECAP_AUDIT_WRITEWrite records to kernel auditing log.CHOWNCAP_CHOWNMake arbitrary changes to file UIDs and GIDs (see chown(2)).NET_RAWCAP_NET_RAWUse RAW and PACKET sockets.DAC_OVERRIDECAP_DAC_OVERRIDEBypass file read, write, and execute permission checks.FOWNERCAP_FOWNERBypass permission checks on operations that normally require the file system UID of the process to match the UID of the file.FSETIDCAP_FSETIDDon’t clear set-user-ID and set-group-ID permission bits when a file is modified.KILLCAP_KILLBypass permission checks for sending signals.SETGIDCAP_SETGIDMake arbitrary manipulations of process GIDs and supplementary GID list.SETUIDCAP_SETUIDMake arbitrary manipulations of process UIDs.NET_BIND_SERVICECAP_NET_BIND_SERVICEBind a socket to internet domain privileged ports (port numbers less than 1024).SYS_CHROOTCAP_SYS_CHROOTUse chroot(2), change root directory.SETFCAPCAP_SETFCAPSet file capabilities.
下面表格中列出的 Capabilities 是 docker 默認刪除的 Capabilities，用戶可以通過 –cap-add 添加其中一個或者多個。
Docker’s capabilitiesLinux capabilitiesCapability DescriptionSYS_MODULECAP_SYS_MODULELoad and unload kernel modules.SYS_RAWIOCAP_SYS_RAWIOPerform I/O port operations (iopl(2) and ioperm(2)).SYS_PACCTCAP_SYS_PACCTUse acct(2), switch process accounting on or off.SYS_ADMINCAP_SYS_ADMINPerform a range of system administration operations.SYS_NICECAP_SYS_NICERaise process nice value (nice(2), setpriority(2)) and change the nice value for arbitrary processes.SYS_RESOURCECAP_SYS_RESOURCEOverride resource Limits.SYS_TIMECAP_SYS_TIMESet system clock (settimeofday(2), stime(2), adjtimex(2)); set real-time (hardware) clock.SYS_TTY_CONFIGCAP_SYS_TTY_CONFIGUse vhangup(2); employ various privileged ioctl(2) operations on virtual terminals.AUDIT_CONTROLCAP_AUDIT_CONTROLEnable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules.MAC_OVERRIDECAP_MAC_OVERRIDEAllow MAC configuration or state changes. Implemented for the Smack LSM.MAC_ADMINCAP_MAC_ADMINOverride Mandatory Access Control (MAC). Implemented for the Smack Linux Security Module (LSM).NET_ADMINCAP_NET_ADMINPerform various network-related operations.SYSLOGCAP_SYSLOGPerform privileged syslog(2) operations.DAC_READ_SEARCHCAP_DAC_READ_SEARCHBypass file read permission checks and directory read and execute permission checks.LINUX_IMMUTABLECAP_LINUX_IMMUTABLESet the FS_APPEND_FL and FS_IMMUTABLE_FL i-node flags.NET_BROADCASTCAP_NET_BROADCASTMake socket broadcasts, and listen to multicasts.IPC_LOCKCAP_IPC_LOCKLock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)).IPC_OWNERCAP_IPC_OWNERBypass permission checks for operations on System V IPC objects.SYS_PTRACECAP_SYS_PTRACETrace arbitrary processes using ptrace(2).SYS_BOOTCAP_SYS_BOOTUse reboot(2) and kexec_load(2), reboot and load a new kernel for later execution.LEASECAP_LEASEEstablish leases on arbitrary files (see fcntl(2)).WAKE_ALARMCAP_WAKE_ALARMTrigger something that will wake up the system.BLOCK_SUSPENDCAP_BLOCK_SUSPENDEmploy features that can block system suspend.
比如，我們可以通過給給容器 add NET_ADMIN Capability，使得我們可以對 network interface 進行 modify，對應的 docker run 命令如下：
$ docker run -it --rm --cap-add=NET_ADMIN ubuntu:14.04 ip link add dummy0 type dummyKubernetes SecurityContext
在 Kubernetes 對 Pod 的定義中，用戶可以 add/drop Capabilities 在 Pod.spec.containers.sercurityContext.capabilities 中添加要 add 的 Capabilities list 和 drop 的 Capabilities list。
比如，我要添加 NET_ADMIN Capability，刪除 KILL Capability，則對應的 Pod 定義如下：
apiVersion: v1
kind: Pod
metadata:
name: hello-world
spec:
containers:
- name: friendly-container
image: alpine:3.4
command: [/bin/echo , hello , world]
securityContext:
capabilities:
add:
- NET_ADMIN
drop:
- KILL感謝各位的閱讀，以上就是“怎么給容器添加 linux Capabilities”的內容了，經過本文的學習后，相信大家對怎么給容器添加 linux Capabilities 這一問題有了更深刻的體會，具體使用情況還需要大家實踐驗證。這里是丸趣 TV，丸趣 TV 小編將為大家推送更多相關知識點的文章，歡迎關注！
