Thomas's team leader wants to prevent a container from gaining new privileges by setting the no_new_priv bit, which applies across clone, execve, and fork system calls to stop a container from acquiring new privileges. Which command should Thomas use to list the security options configured for all containers?
A docker ps --quiet --all | xargs docker inspect --format ‘:SecurityOpt’ B docker ps --quiet --all | xargs docker inspect --format ‘:SecurityOpt=’ C docker ps -quiet -all | xargs docker inspect --format ‘:SecurityOpt’ D docker ps -quiet -all | xargs docker inspect --format ‘:SecurityOpt=’ Show Answer Answer Explanation The correct syntax relies on Docker's standard long-form command-line options, which must be prefixed with double dashes (--quiet and --all), not a single dash — so any command using -quiet or -all is invalid. The command docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}' is the standard technique (used in Docker Bench for Security and CIS Docker Benchmark audits) to list all container IDs and inspect each one's SecurityOpt field, which reveals whether the no-new-privileges option has been applied. The format string includes the literal text 'SecurityOpt=' immediately followed by the templated value, matching the pattern in the correct choice.
Learn more
Community Discussion