ITGSS Certified DevOps Engineer Practice Test

What security risk is associated with the use of the --privileged flag in Docker containers?

1. Access to sensitive logs

2. Full access to all devices

3. Isolation from the network

4. Reduction in resource limits

The correct answer is: Full access to all devices

Using the --privileged flag in Docker containers grants the container extended privileges that allow it to access a broader range of system resources than it normally would. With this flag, the container can interact with the host's kernel directly, meaning it has full control over all devices on the host. This results in a significant security risk because if a container is compromised, the attacker can gain full control over the underlying host system and potentially access sensitive data or services running on it. In contrast, the other options highlight issues that may not necessarily arise from using the --privileged flag. Access to sensitive logs might be possible under various circumstances but is not a direct consequence of the flag, as would be the unrestricted device access. Isolation from the network is not directly related to the use of this flag; rather, it confers the ability for containers to interact more freely with network resources. Lastly, the reduction in resource limits does not apply in this context, as the --privileged flag typically allows a container to bypass certain resource constraints, potentially leading to increased resource consumption rather than a reduction. The significant risk associated with full access to all devices underscores why careful consideration must be applied when deploying containers with elevated permissions.