Skip to main content

CV-C006: Dangerous capabilities added

Error Security

Why This Matters

Adding dangerous Linux capabilities such as SYS_ADMIN, NET_ADMIN, or ALL significantly weakens container isolation. SYS_ADMIN alone grants nearly all privileged operations. ALL grants every capability, equivalent to privileged mode. CWE-250: Execution with Unnecessary Privileges.

How to Fix

Remove dangerous capabilities and add only the minimum required capabilities

Before (incorrect)

services:
  web:
    cap_add:
      - SYS_ADMIN
      - NET_ADMIN

After (correct)

services:
  web:
    cap_add:
      - NET_BIND_SERVICE

Rule Details

Rule Code
CV-C006
Severity
Error
Category
Security

Related Rules

CV-C001 Error

Privileged mode enabled
CV-C002 Error

Docker socket mounted
CV-C003 Error

Host network mode
CV-C004 Error

Host PID mode
CV-C005 Error

Host IPC mode