# No cap\_drop/cap\_add feature support in docker\_container module?

**URL:** <https://forum.ansible.com/t/no-cap-drop-cap-add-feature-support-in-docker-container-module/28156>\
**Category:** Ansible Project\
**Created:** [July 26, 2018, 5:11am UTC](https://forum.ansible.com/t/no-cap-drop-cap-add-feature-support-in-docker-container-module/28156 "2018-07-26T05:11:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Traiano\_Welcome](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Traiano\_Welcome](https://forum.ansible.com/u/Traiano_Welcome)\
**Post date:** [July 26, 2018, 5:11am UTC](https://forum.ansible.com/t/no-cap-drop-cap-add-feature-support-in-docker-container-module/28156/1 "2018-07-26T05:11:07Z")

</div>

Hi

Ansible’s docker\_container module does not implement cap\_drop and cap\_add feature to fully control access to kernel capabilities.

Instead it implements the “capabilities” module for _adding_ capabilities to a container:

[https://docs.ansible.com/ansible/2.4/docker\_container\_module.html#docker-container](https://docs.ansible.com/ansible/2.4/docker_container_module.html#docker-container)

The problem with this is that the “capabilities” parameter only supports _adding_ capabilties, not removing them.

Given this, how is it possible to restrict kernel capabilities beyond the default ?

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [July 27, 2018, 8:15am UTC](https://forum.ansible.com/t/no-cap-drop-cap-add-feature-support-in-docker-container-module/28156/2 "2018-07-27T08:15:32Z")

</div>

Hi,

> Ansible's docker\_container module does not implement cap\_drop and  
> cap\_add feature to fully control access to kernel capabilities.
> 
> Instead it implements the "capabilities" module for \_adding\_  
> capabilities to a container:
> 
> [https://docs.ansible.com/ansible/2.4/docker\_container\_module.html#docker-container](https://docs.ansible.com/ansible/2.4/docker_container_module.html#docker-container)
> 
> The problem with this is that the "capabilities" parameter only  
> supports \_adding\_ capabilties, not removing them.
> 
> Given this, how is it possible to restrict kernel capabilities beyond  
> the default ?

well, first, you can use the command module  
([https://docs.ansible.com/ansible/latest/modules/command\_module.html](https://docs.ansible.com/ansible/latest/modules/command_module.html))  
to use the docker executable to remove the capabilities "by hand".

If you want to have support in the docker\_container module, I'd suggest  
creating an issue for it (and first searching whether someone already  
opened such an issue), or even provide code via a PR which adds a  
'remove\_capabilities' paramater (or however you want to call it) to  
docker\_container.

In fact, it looks like someone already created an issue for this  
yesterday: [https://github.com/ansible/ansible/issues/43293](https://github.com/ansible/ansible/issues/43293)

Cheers,  
Felix

---

<div class="post-metadata">

**Author:** ![Traiano\_Welcome](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Traiano\_Welcome](https://forum.ansible.com/u/Traiano_Welcome)\
**Post date:** [July 27, 2018, 8:44am UTC](https://forum.ansible.com/t/no-cap-drop-cap-add-feature-support-in-docker-container-module/28156/3 "2018-07-27T08:44:03Z")

</div>

Hi Felix