Problem Statement
The NemoClaw Dockerfile runs as non-root user sandbox (good), but does not explicitly drop Linux capabilities. The container inherits whatever default capabilities the container runtime provides.
Current Dockerfile:
Impact
Default Docker capabilities include: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FSETID, CAP_FOWNER, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP.
Several of these are unnecessary for agent workloads and present attack surface:
CAP_NET_RAW — allows raw socket creation (packet crafting, ARP spoofing)CAP_DAC_OVERRIDE — bypasses file permission checksCAP_SYS_CHROOT — allows chroot callsCAP_KILL — allows sending signals to processes
Proposed Design
Add explicit capability dropping to the Dockerfile or document the required docker run flags:
# In docker-compose.yml or run command:
cap_drop:
- ALL
cap_add:
- NET_BIND_SERVICE # only if needed
This is a one-line change with significant security impact. Defense-in-depth: even if the sandbox user is compromised, capabilities are not available.
References
- CIS Docker Benchmark 5.3: "Restrict Linux kernel capabilities within containers"
- Docker security best practices documentation
Alternatives Considered
No response
Category
enhancement: feature
Checklist
Problem Statement
The NemoClaw Dockerfile runs as non-root user
sandbox(good), but does not explicitly drop Linux capabilities. The container inherits whatever default capabilities the container runtime provides.Current Dockerfile:
USER sandboxImpact
Default Docker capabilities include:
CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FSETID,CAP_FOWNER,CAP_KILL,CAP_SETGID,CAP_SETUID,CAP_SETPCAP,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SYS_CHROOT,CAP_MKNOD,CAP_AUDIT_WRITE,CAP_SETFCAP.Several of these are unnecessary for agent workloads and present attack surface:
CAP_NET_RAW— allows raw socket creation (packet crafting, ARP spoofing)CAP_DAC_OVERRIDE— bypasses file permission checksCAP_SYS_CHROOT— allows chroot callsCAP_KILL— allows sending signals to processesProposed Design
Add explicit capability dropping to the Dockerfile or document the required
docker runflags:# In docker-compose.yml or run command: cap_drop: - ALL cap_add: - NET_BIND_SERVICE # only if neededThis is a one-line change with significant security impact. Defense-in-depth: even if the sandbox user is compromised, capabilities are not available.
References
Alternatives Considered
No response
Category
enhancement: feature
Checklist