A civic HTTPS reverse-proxy container only needs to bind privileged ports. How should Linux capabilities be configured for least privilege?
Select an answer to reveal the explanation.
Short Explanation
Capabilities are like individual power tools—don't hand over the whole workshop. Drop ALL, then add back only NET_BIND_SERVICE if the proxy must bind low ports. Privileged or SYS_ADMIN is a sledgehammer for a thumbtack job.
Full Explanation
Container capability hygiene typically starts with capabilities.drop: ["ALL"] and then capabilities.add for the minimum needed set. NET_BIND_SERVICE covers binding ports below 1024 without granting broader admin capabilities. privileged: true or adding CAP_SYS_ADMIN/CAP_NET_ADMIN far exceeds what a simple bind requires; the image USER alone does not drop capabilities.