A mechanism that splits the powerful privileges of root into fine-grained units that can be granted individually.
Traditionally it was an all-or-nothing choice between root and a regular user, but capabilities let you grant a process only the minimum privilege it needs—such as the ability to bind to a specific port—nothing more. This concept is commonly used to harden container security.
© 2026 ITBGM