DCA · Question #164
Which 'docker run' flag lifts cgroup limitations?
The correct answer is C. 'docker run --privileged'. The docker run --privileged flag grants a container extensive host capabilities, effectively lifting most cgroup and security limitations.
Question
Which 'docker run' flag lifts cgroup limitations?
Options
- A'docker run --isolation'
- B'docker run --cap-drop'
- C'docker run --privileged'
- D'docker run --cpu-period'
How the community answered
(32 responses)- A3% (1)
- B3% (1)
- C88% (28)
- D6% (2)
Why each option
The `docker run --privileged` flag grants a container extensive host capabilities, effectively lifting most cgroup and security limitations.
`--isolation` is used on Windows to specify the isolation technology and does not directly lift Linux cgroup limitations.
`--cap-drop` is used to remove specific Linux capabilities from a container, which *increases* restrictions rather than lifting them.
The `--privileged` flag gives a container full access to devices on the host and allows it to bypass many cgroup limitations and kernel capabilities restrictions. This effectively "lifts" most resource and security limitations imposed by cgroups and other kernel mechanisms, granting the container almost the same privileges as a process running directly on the host.
`--cpu-period` is a cgroup parameter used to *define* CPU resource limits, not to lift them.
Concept tested: Docker container runtime privileges
Source: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
Topics
Community Discussion
No community discussion yet for this question.