Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Default behaviour of `--cap-drop`

Open
  • Is something wrong?
#561 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
30/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
c, linux
Domain
cli, operating-systems, security

Research direction

Start by reproducing the documented --cap-drop examples and comparing the reported capability sets. Read the --cap-drop entry point and its documentation to determine whether the default behavior or the wording is incorrect; done means the behavior is explained accurately and the issue's discrepancy is resolved.

Written by the indexing model from the issue text.

Description

The documentation of --cap-drop states:

By default no caps are left in the sandboxed process.

That seems not to be true:

id
uid=0(root) gid=0(root) groups=0(root)

getpcaps $$
14257: =ep

bwrap --bind / / sh -c 'getpcaps $$'
15598: =ep

bwrap --bind / / --cap-drop ALL sh -c 'getpcaps $$'
15577: =
Dominant language
C
Stars
8.9k
Forks
391
Avg merge
1d 32m
Merged PRs (30d)
7

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from containers/bubblewrap

All issues in containers/bubblewrap

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.