Entering other containers’ network namespaces with the setns() call to open their network adapters for capture requires either privileged mode or SYS_ADMIN and SYS_PTRACE capabilities. If you prefer to use the SYS_ADMIN and SYS_PTRACE capabilities rather than privileged mode, you can replace privileged: true within the deployment definitions with the following:
However, Alert Logic does not recommend the above change. The amount of access granted with these capabilities makes maintaining more granular control of the al-agent-container not worthwhile, because any malicious process granted the above set can escalate to a fully privileged mode. Additionally, future versions of the agent may require extra capabilities for new functionality and could break remote updates if a more restricted set is used. Therefore, customers choosing to restrict al-agent-container capabilities in the above manner must do so at their own risk.