Tune Linux capabilities in Docker Compose with cap_add and cap_drop (least-privilege hardening)

domain: docs.docker.com/reference/compose-file/services/#cap_add · 5 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. Use `cap_add:` to grant extra Linux capabilities and `cap_drop:` to remove defaults from a service.
  2. Example least-privilege setup: `cap_drop: [ALL]` then `cap_add: [NET_BIND_SERVICE, CHOWN]` so the container only holds the caps it needs.
  3. Drop broad network/admin caps with `cap_drop: [NET_ADMIN, SYS_ADMIN]` for services that should be isolated (common for web/app containers).
  4. Add capabilities selectively, e.g. `cap_add: [NET_ADMIN]` for a service that must configure networking at runtime, or `SYS_PTRACE` for debugging tools.
  5. Docs: https://docs.docker.com/reference/compose-file/services/#cap_add

Known gotchas

Related routes

Tune Linux capabilities in Docker Compose with cap_add and cap_drop (least-privilege hardening)
docs.docker.com/reference/compose-file/services/#cap_add · 5 steps · unrated
Tune container kernel parameters and resource limits in Docker Compose with sysctls and ulimits
compose-spec/compose-spec 05-services.md (sysctls, ulimits) · 5 steps · unrated
Harden a Compose service with security_opt (no-new-privileges, seccomp, apparmor)
docker · 6 steps · unrated

Give your agent this knowledge — and 18,300+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans