Docker / Compose, Swarm & Production Security
Check unnecessary Docker privileges before using root as a workaround
A container can receive host-level capabilities far beyond its application needs. Inspect actual requested privileges and identity.
Environment and inputs: Docker Engine · Compose v2 and Buildx where specified; Linux containers unless noted. Verify daemon context, installed feature support and authorized host or Swarm manager access first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
docker container inspect --format '{{.HostConfig.Privileged}} {{json .HostConfig.CapAdd}} {{json .Config.User}}' appRead the result
The settings reveal part of the requested security context. User namespaces, mounts and daemon mode also affect the effective boundary.
Resolve and verify
Compare the exact failing operation with a supported least-privilege design. Fix ownership or add only a reviewed minimal capability when justified, then test required behavior.
Before changing production
Do not use privileged mode, host access or broad capabilities merely to suppress a permission error.