# Dockerコマンド、Dockerfile・Compose file リファレンス

**URL:** https://forum.ficusonline.com/t/topic/128
**Category:** Server
**Created:** [2017 年 9 月 2 日午前 7:44 UTC](https://forum.ficusonline.com/t/topic/128 "2017-09-02T07:44:03Z")
**Posts on this page:** 1
**Showing post:** 34

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2021 年 4 月 8 日午前 4:43 UTC](https://forum.ficusonline.com/t/topic/128/34 "2021-04-08T04:43:42Z")

</div>

## Runtime privilege and Linux capabilities

> **[Running containers](https://docs.docker.com/engine/containers/run/)**
>
> Running and configuring containers with the Docker CLI

| Option | Description |
| --- | --- |
| –cap-add | Add Linux capabilities |
| –cap-drop | Drop Linux capabilities |
| –privileged | Give extended privileges to this container |
| –device= | Allows you to run devices inside the container without the --privileged flag. |

| Capability Key | Capability Description |
| --- | --- |
| AUDIT\_CONTROL | Enable and disable kernel auditing; change auditing filter rules; retrieve auditing status and filtering rules. |
| AUDIT\_READ | Allow reading the audit log via multicast netlink socket. |
| BLOCK\_SUSPEND | Allow preventing system suspends. |
| BPF | Allow creating BPF maps, loading BPF Type Format (BTF) data, retrieve JITed code of BPF programs, and more. |
| CHECKPOINT\_RESTORE | Allow checkpoint/restore related operations. Introduced in kernel 5.9. |
| DAC\_READ\_SEARCH | Bypass file read permission checks and directory read and execute permission checks. |
| IPC\_LOCK | Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)). |
| IPC\_OWNER | Bypass permission checks for operations on System V IPC objects. |
| LEASE | Establish leases on arbitrary files (see fcntl(2)). |
| LINUX\_IMMUTABLE | Set the FS\_APPEND\_FL and FS\_IMMUTABLE\_FL i-node flags. |
| MAC\_ADMIN | Allow MAC configuration or state changes. Implemented for the Smack LSM. |
| MAC\_OVERRIDE | Override Mandatory Access Control (MAC). Implemented for the Smack Linux Security Module (LSM). |
| NET\_ADMIN | Perform various network-related operations. |
| NET\_BROADCAST | Make socket broadcasts, and listen to multicasts. |
| PERFMON | Allow system performance and observability privileged operations using perf\_events, i915\_perf and other kernel subsystems |
| SYS\_ADMIN | Perform a range of system administration operations. |
| SYS\_BOOT | Use reboot(2) and kexec\_load(2), reboot and load a new kernel for later execution. |
| SYS\_MODULE | Load and unload kernel modules. |
| SYS\_NICE | Raise process nice value (nice(2), setpriority(2)) and change the nice value for arbitrary processes. |
| SYS\_PACCT | Use acct(2), switch process accounting on or off. |
| SYS\_PTRACE | Trace arbitrary processes using ptrace(2). |
| SYS\_RAWIO | Perform I/O port operations (iopl(2) and ioperm(2)). |
| SYS\_RESOURCE | Override resource Limits. |
| SYS\_TIME | Set system clock (settimeofday(2), stime(2), adjtimex(2)); set real-time (hardware) clock. |
| SYS\_TTY\_CONFIG | Use vhangup(2); employ various privileged ioctl(2) operations on virtual terminals. |
| SYSLOG | Perform privileged syslog(2) operations. |
| WAKE\_ALARM | Trigger something that will wake up the system. |

---

_[View the full topic](https://forum.ficusonline.com/t/topic/128)._