Dev Tools · 1h ago
When --cap-drop ALL Broke a Unix Socket Gate
A Docker container hardened with --cap-drop ALL failed to connect to a Unix domain socket because the socket's mode 0775 lacked write permission for others. The missing CAP_DAC_OVERRIDE capability prevented the root process from bypassing permission bits. This caused an AI agent governance plane to log zero decisions, breaking its CI pipeline.
Meridian48 take
The story highlights a subtle but critical interaction between Linux capabilities and Unix socket permissions, a reminder that security hardening can break assumptions in containerized toolchains.
linux-capabilitiesunix-sockets