I am using rootless containers, according to the buildah docs,

Moreover, pinging from a rootless container does not work because it lacks the CAP_NET_RAW security capability that the ping command requires. If you want to ping from within a rootless container, you can allow users to send ICMP packets using this sysctl command:

# sysctl -w "net.ipv4.ping_group_range=0 2000000" 

This action would allow any process within these groups to send ping packets.

I ran that sysctl command, and I checked the permissions on the container it says,

Current IAB: ... !cap_net_raw ...

So if you set net.ipv4.ping_group_range you do NOT need this capability? How are these two related?


There’s no direct relationship. CAP_NET_RAW is a capability which allows the use of raw and packet sockets, and binding to any address for transparent proxying. ping_group_range is a sysctl defining a group range allowed to open ICMP echo sockets.

Both of these can be used to allow ping to send and receive ICMP echo packets, but they’re not a superset or subset of each other.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.