{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/13875","labels_url":"https://api.github.com/repos/docker/docker/issues/13875/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/13875/comments","events_url":"https://api.github.com/repos/docker/docker/issues/13875/events","html_url":"https://github.com/docker/docker/issues/13875","id":87242726,"number":13875,"title":"what is the impact of running with --cap-add SYS_ADMIN --device /dev/fuse","user":{"login":"eyalto","id":855952,"avatar_url":"https://avatars.githubusercontent.com/u/855952?v=3","gravatar_id":"","url":"https://api.github.com/users/eyalto","html_url":"https://github.com/eyalto","followers_url":"https://api.github.com/users/eyalto/followers","following_url":"https://api.github.com/users/eyalto/following{/other_user}","gists_url":"https://api.github.com/users/eyalto/gists{/gist_id}","starred_url":"https://api.github.com/users/eyalto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eyalto/subscriptions","organizations_url":"https://api.github.com/users/eyalto/orgs","repos_url":"https://api.github.com/users/eyalto/repos","events_url":"https://api.github.com/users/eyalto/events{/privacy}","received_events_url":"https://api.github.com/users/eyalto/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-11T07:25:36Z","updated_at":"2015-06-11T14:36:01Z","closed_at":"2015-06-11T14:36:01Z","body":"Description of problem:\r\n\r\nfollowing:\r\nhttps://github.com/docker/docker/issues/6535\r\nhttps://github.com/docker/docker/issues/9448\r\nhttps://github.com/SvenDowideit/docker/commit/e2c3da6e7a40008c6e8c4c8ae2fdfc0f382af0a3\r\n\r\nI would like to understand what is the impact (i.e. what other things the root user within the container will be able to do) if I enable both device and capability\r\n\r\nI have a docker running dev env for multiple users - I would like to mount a remote shared folder every time a developer opens a new project. I would like to mount sshfs folder in a running docker without stopping it and attaching a volume.\r\n\r\ndocker version:\r\nDocker version 1.5.0, build a8a31ef\r\n\r\ndocker info:\r\nContainers: 71\r\nImages: 16\r\nStorage Driver: aufs\r\n Root Dir: /var/lib/docker/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 158\r\nExecution Driver: native-0.2\r\nKernel Version: 3.13.0-48-generic\r\nOperating System: Ubuntu 14.04.2 LTS\r\nCPUs: 48\r\nTotal Memory: 62.81 GiB\r\nName: zegpu2\r\nID: YEQH:R4KO:NHGX:H6VN:5XHQ:HBBG:MGHV:7E7I:ATMV:RSKU:BRYN:IWKQ\r\nDebug mode (server): false\r\nDebug mode (client): true\r\nFds: 523\r\nGoroutines: 517\r\nEventsListeners: 0\r\nInit Path: /usr/bin/docker\r\nDocker Root Dir: /var/lib/docker\r\nWARNING: No swap limit support\r\n\r\nuname -a:\r\nLinux 3.13.0-48-generic #80-Ubuntu SMP Thu Mar 12 11:16:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\nenvironment :  Ubuntu 14.04.2 LTS ==>  Physical\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/111156497","html_url":"https://github.com/docker/docker/issues/13875#issuecomment-111156497","issue_url":"https://api.github.com/repos/docker/docker/issues/13875","id":111156497,"user":{"login":"cpuguy83","id":799078,"avatar_url":"https://avatars.githubusercontent.com/u/799078?v=3","gravatar_id":"","url":"https://api.github.com/users/cpuguy83","html_url":"https://github.com/cpuguy83","followers_url":"https://api.github.com/users/cpuguy83/followers","following_url":"https://api.github.com/users/cpuguy83/following{/other_user}","gists_url":"https://api.github.com/users/cpuguy83/gists{/gist_id}","starred_url":"https://api.github.com/users/cpuguy83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpuguy83/subscriptions","organizations_url":"https://api.github.com/users/cpuguy83/orgs","repos_url":"https://api.github.com/users/cpuguy83/repos","events_url":"https://api.github.com/users/cpuguy83/events{/privacy}","received_events_url":"https://api.github.com/users/cpuguy83/received_events","type":"User","site_admin":false},"created_at":"2015-06-11T14:36:01Z","updated_at":"2015-06-11T14:36:01Z","body":"Article on CAP_SYS_ADMIN: https://lwn.net/Articles/486306/\r\nIf a user has it... they are not contained.\r\n\r\nClosing since this is not an issue."}}