DCA · Question #136
A users attempts to set the system time from inside a Docker container are unsuccessful. Could this be blocking this operation? Solution: Linux capabilities
The correct answer is A. Yes. Linux capabilities restrict privileged operations within containers, and setting the system time typically requires a capability that is dropped by default for security.
Question
A users attempts to set the system time from inside a Docker container are unsuccessful. Could this be blocking this operation? Solution: Linux capabilities
Options
- AYes
- BNo
How the community answered
(42 responses)- A93% (39)
- B7% (3)
Why each option
Linux capabilities restrict privileged operations within containers, and setting the system time typically requires a capability that is dropped by default for security.
Docker containers typically run with a reduced set of Linux capabilities by default for security, meaning certain privileged system calls are disallowed. Setting the system time requires the `CAP_SYS_TIME` capability, which is usually removed from standard containers, thereby blocking this operation.
Linux capabilities are specifically designed to control granular permissions for processes, and their absence for a particular operation like `CAP_SYS_TIME` is a direct cause for an attempt to set system time to fail.
Concept tested: Linux capabilities and Docker security
Source: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
Topics
Community Discussion
No community discussion yet for this question.