From 978dc41e6051348fd52611faabf55a415a63bba8 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Tue, 6 Jan 2015 09:39:17 +0000 Subject: [PATCH] note that for app isolation CAP_NET_RAW needs to be dropped See also #316 --- site/features.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/site/features.md b/site/features.md index e27b9b45..c4c4a3e7 100644 --- a/site/features.md +++ b/site/features.md @@ -95,7 +95,9 @@ same host, via their docker-assigned IP addresses. For complete isolation between application containers, that feature needs to be disabled by [setting `--icc=false`](https://docs.docker.com/articles/networking/#between-containers) -in the docker daemon configuration. +in the docker daemon configuration. Furthermore, containers should be +prevented from capturing and injecting raw network packets - this can +be accomplished by starting them with the `--cap-drop net_raw` option. ### Dynamic network attachment