title: Why is granting the SYS_ADMIN privilege for a Docker container "bad"?
body: <p>I am running into issues with security teams because engineering teams want to FUSE mount a filesystem in Docker, however, to do that, the "--cap-add SYS_ADMIN" flag must be set. Security is not allowing this flag.</p>
  
  <p>I have found a lot of articles on the Internet regarding the "--cap-add SYS_ADMIN" flag during the Docker runtime as something to be cautious of because "SYS_ADMIN by itself grants quite a big part of the capabilities and it could potentially present more attack surface."</p>
  
  <p>However, I cannot find anything which specifically states what these capabilities are and what "attack surfaces" they present?</p>
  
  <p>What exactly does the SYS_ADMIN flag grant?</p>
  
  <p>What is a practical security risk that is presented by setting this flag?</p>