What does the --privileged flag do and why avoid it?
--privileged gives the container nearly all Linux capabilities and access to all host devices, removing most isolation. A compromised privileged container can often take over the host, so use it rarely, if at all.
Explain it simply
Normal containers get a limited visitor pass. --privileged is handing over the master keys, the CCTV room and the main gate.
It grants every capability, disables seccomp and AppArmor restrictions, and exposes host devices under /dev. From inside, one can mount host disks, load kernel modules or change network settings. It exists for special cases such as running Docker inside Docker for CI, or low-level hardware tools.
If you need one specific power, grant just that: --cap-add NET_ADMIN for network tools or --device /dev/ttyUSB0 for one device. In Kubernetes, securityContext.privileged: true is flagged by almost every policy engine for the same reasons. Likewise, never mount /var/run/docker.sock into untrusted containers; it is equivalent to root on the host.
Example
docker run --privileged ubuntu # avoid
docker run --cap-add NET_ADMIN alpine ip link
docker run --device /dev/ttyUSB0 myapp # one device onlyWhat to say in the interview
"--privileged gives all capabilities and host devices, which largely removes isolation. I grant only the specific capability or device needed, and I never expose the Docker socket to untrusted containers."
Common mistakes
- Using --privileged to fix a permission error instead of finding the missing permission.