advancedTop 100 Interview Questions

What does `--cap-drop=ALL` followed by selectively adding capabilities back accomplish?

It follows the principle of least privilege at the Linux capability level — instead of granting a container the default broad capability set, you drop everything and re-add only the specific capabilities the application actually needs, minimizing what a compromised process could do.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Sign in to generate a response

Next Step

Continue to Why are container logs ephemeral by default, and what's the production implication?← Back to all Docker questions