When I run a command within a docker container, I see:
# ip netns exec 9ee961d90990 ifconfig setting the network namespace "9ee961d90990" failed: Operation not permitted
I can launch my container with expanded capabilities directly (I have added the
net_admin one) but is there any way to check what system capability is required in order to run this command?
It is possible to start the container with
--privileged to do this and trample over everything security related associated with docker but I'd rather avoid doing this if at all possible. Doing this does allow the above command to succeed.