From 537893253f98d719185439899af05e032f82dda3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolai=20von=C2=A0Neudeck?= <nicolai@vonneudeck.com>
Date: Tue, 29 Nov 2016 00:11:40 +0100
Subject: [PATCH] Added info about where to add/drop capabilities

The user-guide did not mention where to drop/add capabilities in Kubernetes.
Added a link to the not yet complete API documentation and an example.
---
 docs/user-guide/containers.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md
index cf05278801..26eceebbce 100644
--- a/docs/user-guide/containers.md
+++ b/docs/user-guide/containers.md
@@ -94,3 +94,24 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m
 | SETFCAP |  CAP_SETFCAP |
 | WAKE_ALARM |  CAP_WAKE_ALARM |
 | BLOCK_SUSPEND |  CAP_BLOCK_SUSPEND |
+
+Capabilities are added/dropped in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.:
+
+```
+apiVersion: v1
+kind: Pod
+metadata:
+ name: hello-world
+spec:
+ containers:
+ - name: friendly-container
+   image: "alpine:3.4"
+   command:
+   - echo "hello"
+   securityContext:
+     capabilities:
+       add:
+       - SYS_NICE
+       drop:
+       - KILL
+```