How to fix Error response from daemon: operation not permitted (no-new-privileges) in Docker

# Test without no-new-privileges
docker run --security-opt no-new-privileges=false your-image

# Or explicitly allow privilege escalation
docker run --security-opt no-new-privileges:false your-image

# Check daemon configuration
cat /etc/docker/daemon.json | grep -i priv

# Check docker info for security options
docker info --format '{{.SecurityOptions}}'

# Using colon separator (recommended)
docker run --security-opt no-new-privileges:true your-image
docker run --security-opt no-new-privileges:false your-image

# Using equals sign
docker run --security-opt no-new-privileges=true your-image
docker run --security-opt no-new-privileges=false your-image

# Short form (enables it)
docker run --security-opt no-new-privileges your-image

services:
  myapp:
    image: your-image
    security_opt:
      - no-new-privileges:true

# Check SELinux status
getenforce

# Check for recent SELinux denials
sudo ausearch -m AVC -ts recent | grep docker

# Or check the audit log
sudo grep -i "denied.*docker" /var/log/audit/audit.log

# On RHEL/CentOS 7/8
sudo yum update container-selinux

# On Fedora
sudo dnf update container-selinux

# Restart Docker after update
sudo systemctl restart docker

# Temporary - resets on reboot
sudo setenforce 0

# Test the container
docker run --security-opt no-new-privileges:true your-image

# Re-enable enforcing mode
sudo setenforce 1

# Check what transition is being blocked
sudo ausearch -m AVC -ts recent | grep "type=.*denied"

# Use iputils-ping with capabilities instead of setuid
RUN apt-get update && apt-get install -y iputils-ping \
    && setcap cap_net_raw+ep /bin/ping

# Instead of running as root and using sudo
USER appuser

docker run --user 1000:1000 your-image

# Do privileged operations during build
RUN chown -R appuser:appuser /app
RUN chmod +x /app/scripts/*.sh

# Then run as non-root
USER appuser

docker run --security-opt no-new-privileges=false your-image

services:
  myapp:
    image: your-image
    security_opt:
      - no-new-privileges=false

# Edit daemon.json
sudo nano /etc/docker/daemon.json

{
  "no-new-privileges": false
}

sudo systemctl restart docker

# In your pod/deployment spec
spec:
  containers:
  - name: myapp
    securityContext:
      allowPrivilegeEscalation: false  # This enables no-new-privileges

spec:
  containers:
  - name: myapp
    securityContext:
      allowPrivilegeEscalation: true

# Check for PodSecurityPolicies (deprecated in 1.25)
kubectl get psp

# Check for admission controller configurations
kubectl get validatingwebhookconfigurations
kubectl get mutatingwebhookconfigurations

# Get container ID from failed start
docker ps -a

# Check logs
docker logs <container_id>

# Inspect the container
docker inspect <container_id> | grep -A 10 "SecurityOpt"

# Run interactively to see startup errors
docker run -it --security-opt no-new-privileges:true your-image /bin/sh

# If that works, try the actual entrypoint
docker run -it --security-opt no-new-privileges:true your-image

# Inspect the image entrypoint
docker inspect your-image --format='{{.Config.Entrypoint}}'
docker inspect your-image --format='{{.Config.Cmd}}'