Will It Vibe?Dangerous Linux capability added
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
capabilities.add includes a high-risk capability (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, BPF, and similar) that grants host-level power.
Why it matters
The flagged capability (for example SYS_ADMIN, NET_ADMIN, SYS_PTRACE, or BPF) grants powers well beyond the container default. SYS_ADMIN alone is broad enough to be a documented escape route, and the others allow tracing other processes, reconfiguring the network, or loading kernel programs. Each one materially raises the risk of a breakout.
How to fix it
Remove the dangerous capability from capabilities.add unless the workload provably needs it. Keep capabilities.drop: ["ALL"] as the baseline and grant the narrowest capability that solves the actual requirement. For workloads that need broad host access (some CNI or observability agents), isolate them on dedicated nodes and namespaces rather than granting the capability widely.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo