How to: show ownership by ids, output - `permision number_of_links user group size date_time_created file_or_folder_name`
ls -ln
```

#### Capabilities

In the context of permission checks, processes running on unix-based systems are traditionally categorised as:

- _privileged_ processes: effective UID is 0 (root) - bypass all kernel permission checks
- _unprivileged_ processes: effective UID is nonzero - subject to permission checks

Starting with kernel 2.2, Linux further divides traditional root privileges into distinct units known as _capabilities_ as a way to control root user powers. Each root _capability_ can be independently enabled and disabled. \
See the [overview of Linux _capabilities_](https://man7.org/linux/man-pages/man7/capabilities.7.html) for more details, including a comprehensive list of capabilities.

> `CAP_SYS_ADMIN` is an overloaded capability that grants privileges similar to traditional root privileges \
> By default, Docker containers are **_unprivileged_** and root in a docker container uses [_restricted capabilities_](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities) \
> ❌ `docker run --privileged` gives all capabilities to the container, allowing nearly all the same access to the host as processes running on the host

#### Running containers as non-root

For practical reasons, most containers run as root by default. However, in a security context, this is bad practice:

- it voilates the [_principle of least privilege_](https://en.wikipedia.org/wiki/Principle_of_least_privilege)
- an attacker might take advantage of an application vulnerability to gain root access to the container
- an attacker might take advantage of a container-runtime, or kernel, vulnerability to gain root access to the host after gaining access to the container

We can control the users containers run with by:

- omitting the `USER` command in Dockerfile assigns root
- specify a user in the `Dockerfile` with the `USER` command
- override the UID at runtime with `docker run --user $UID`

```Dockerfile