Linux containers in 500 lines of code (2016)
The root capabilities section is worrying. Instead of trying to exhaustively list every capability that needs to be dropped, shouldn't the code instead just list the capabilities that are allowed, and clear all the others?This would seem to better guard against accidentally missing existing capabilities, and also protect against newer capabilities that might be added in a future kernel.