What is Kubernetes Pod Security Context Capabilities?

Question

Accepted Answer

**Capabilities** — fine-grained Linux privileges.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: capabilities-pod
spec:
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
        - CHOWN
```

```bash
kubectl exec capabilities-pod -- cat /proc/1/status | grep Cap
```

**Common:** NET_BIND_SERVICE, CHOWN, DAC_OVERRIDE, FOWNER, SETGID, SETUID.

DevOps: What is Kubernetes Pod Security Context Capabilities?