Merge pull request #1804 from vonneudeck/patch-1

Added info about where to add/drop capabilities
2017-01-13 17:43:21 -08:00
parent 4143b1c1c1 06d21c950f
commit c29b4868e6
1 changed files with 20 additions and 0 deletions
@@ -94,3 +94,23 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m
 | SETFCAP |  CAP_SETFCAP |
 | WAKE_ALARM |  CAP_WAKE_ALARM |
 | BLOCK_SUSPEND |  CAP_BLOCK_SUSPEND |
 You can add or drop capabilities in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.:
 ```yaml
 apiVersion: v1
 kind: Pod
 metadata:
  name: hello-world
 spec:
  containers:
  - name: friendly-container
    image: "alpine:3.4"
    command: ["/bin/echo", "hello", "world"]
    securityContext:
      capabilities:
        add:
        - SYS_NICE
        drop:
        - KILL
 ```