This blog post outlines some container hardening methods and there’s some stuff in there which seems relevant to the security-misc hardening we do. What caught my attention was the fact that unprivileged ping was possible. I noticed that currently ping requires CAP_NET_RAW which is restricted even with sysmaint, but apparently the kernel is capable of not needing it with this use case.
CAP_NET_RAW is still granted to every container (even though the kernel has supported unprivileged ICMP sockets for over a decade, meaning most modern distributions no longer need CAP_NET_RAW for ping)