I spend a lot of time working on crun and on how containers are kept separated from the host. Capabilities are one of the tools we use for that: instead of giving a container the full power of root, we hand out only the small pieces it needs. CAP_SYS_ADMIN gets most of the attention, since it is so powerful that people call it the new root, and dropping it is often treated as enough to make a container safe. I want to look at another capability that doesn’t sound so dangerous: CAP_SYS_PTRACE.