Linux divides privileges that are traditionally associated with superusers into distinct units, known as capabilities (run man capabilities on a Linux-based system), which can be independently enabled and disabled. For example, the net_bind_service capability allows nonuser processes to bind the port below 1,024. By default, Docker starts containers with limited capabilities. With privileged access inside the container, we allocate more capabilities to perform operations that are normally done by the root user. In order to have a better understanding of privileged mode, let's first try a simple mount on an unprivileged container and observe the effect:
