class Aws::ECS::Types::KernelCapabilities

The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker. For more information on the default capabilities and the non-default available capabilities, see [Runtime privilege and Linux capabilities] in the *Docker run reference*. For more detailed information on these Linux capabilities, see the [capabilities(7)] Linux manual page.

[1]: docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities [2]: man7.org/linux/man-pages/man7/capabilities.7.html

@note When making an API call, you may pass KernelCapabilities

data as a hash:

    {
      add: ["String"],
      drop: ["String"],
    }

@!attribute [rw] add

The Linux capabilities for the container that have been added to the
default configuration provided by Docker. This parameter maps to
`CapAdd` in the [Create a container][1] section of the [Docker
Remote API][2] and the `--cap-add` option to [docker run][3].

<note markdown="1"> Tasks launched on Fargate only support adding the `SYS_PTRACE`
kernel capability.

 </note>

Valid values: `"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" |
"BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" |
"FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" |
"LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" |
"NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" |
"SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" |
"SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT"
| "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" |
"SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"`

[1]: https://docs.docker.com/engine/api/v1.35/#operation/ContainerCreate
[2]: https://docs.docker.com/engine/api/v1.35/
[3]: https://docs.docker.com/engine/reference/run/#security-configuration
@return [Array<String>]

@!attribute [rw] drop

The Linux capabilities for the container that have been removed from
the default configuration provided by Docker. This parameter maps to
`CapDrop` in the [Create a container][1] section of the [Docker
Remote API][2] and the `--cap-drop` option to [docker run][3].

Valid values: `"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" |
"BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" |
"FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" |
"LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" |
"NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" |
"SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" |
"SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT"
| "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" |
"SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"`

[1]: https://docs.docker.com/engine/api/v1.35/#operation/ContainerCreate
[2]: https://docs.docker.com/engine/api/v1.35/
[3]: https://docs.docker.com/engine/reference/run/#security-configuration
@return [Array<String>]

@see docs.aws.amazon.com/goto/WebAPI/ecs-2014-11-13/KernelCapabilities AWS API Documentation

Constants

SENSITIVE