A Debugging Story That Will Change How You Think About Container Capabilities

You are a platform engineer running OpenShift. A development team runs a monitoring sidecar as a non-root user that needs to perform ICMP ping health checks. They need CAP_NET_RAW - the capability required for raw socket access. Straightforward enough.

The SCC is configured to allow the capability:

apiVersion: security.openshift.io/v1

kind: SecurityContextConstraints