Diagnostic code

ZBX-E0207

can't restrict the container's capabilities

Kind

error

Blame

environment

Exit code

2 (125 in zbx run)

What it means

Just before the command starts, zbx drops every capability the container does not keep: from the bounding set, then from the effective, permitted and inheritable sets, and it empties the ambient set. The list that is kept is Docker's default without NET_RAW and MKNOD, and has no SYS_ADMIN (src/runtime/policy/capabilities.zon). The kernel refused one of those calls, so the container was not started: a container with more rights than intended is never run.

The cause names the step and the kernel's reason. This is unusual: the child is root of its own user namespace and holds these capabilities there. A security module that restricts capability changes, or a very old kernel, is the likely reason.

Offline

The same text, without a network:

zbx explain E0207