When I run a command within a docker container, I see:

# ip netns exec 9ee961d90990 ifconfig
setting the network namespace "9ee961d90990" failed: Operation not permitted

I can launch my container with expanded capabilities directly (I have added the net_admin one) but is there any way to check what system capability is required in order to run this command?

It is possible to start the container with --privileged to do this and trample over everything security related associated with docker but I'd rather avoid doing this if at all possible. Doing this does allow the above command to succeed.


According to the setns(2) man page you'll need CAP_ADMIN in order to join the target network namespace. But you may probably need additional capabilities because setns() is used with a file descriptor to /run/netns/.... You don't tell how you've created this network namespace, so I assume it has been created through ip netns add ..., so it's a bind-mounted network namespace pointing into nsfs anyway. Since /run/netns/... is usually root-territory, you probably need CAP_DAC_OVERRIDE or CAP_DAC_READ_SEARCH too, see also capabilities(7) man page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.