docker run --cap-drop ALL --cap-add NET_BIND_SERVICE myapp
Run with minimal Linux capabilities
Drops every Linux capability (privileged operations) then re-adds only NET_BIND_SERVICE, enough for binding low ports. Capabilities gate kernel-level actions; this is defense-in-depth, not a sandbox. Use --security-opt for further hardening.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.