What is Kubernetes Pod Security Context Capabilities Drop All?

Question

Accepted Answer

**Drop All Capabilities** — remove all Linux capabilities.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: drop-all-pod
spec:
  securityContext:
    runAsNonRoot: true
  containers:
  - name: app
    image: nginx:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
```

```bash
kubectl exec drop-all-pod -- cat /proc/1/status | grep Cap
```

**Best Practice:** drop ALL, add only what's needed.

DevOps: What is Kubernetes Pod Security Context Capabilities Drop All?