kube-dns cannot run as non-root user

[diegs]

I attempted to run kube-dns as a non-root user by modifying the example YAML files to:

• have dnsmasq serve on a high port using the --port flag
• fix the service to point at the high port
• add a non-root security context to the pod

This seems like it would be sufficient, but then I found that there are several hard-coded assumptions in the container image that dnsmasq will run as root:

https://github.com/kubernetes/dns/blob/master/images/dnsmasq/Dockerfile.cross
https://github.com/kubernetes/dns/blob/master/images/dnsmasq/dnsmasq.conf

Unless there is a strong reason why dnsmasq needs to run as root, I think it would be a better practice to run it as non-root.

[thockin]

I would love for it to run as non-root. cap_net_bind_service might allow us to not muck with ports, too.

…

On Tue, Jan 23, 2018 at 1:15 PM, Diego Pontoriero ***@***.***> wrote: I attempted to run kube-dns as a non-root user by modifying the example YAML files to: - have dnsmasq serve on a high port using the --port flag - fix the service to point at the high port - add a non-root security context to the pod This seems like it would be sufficient, but then I found that there are several hard-coded assumptions in the container image that dnsmasq will run as root: https://github.com/kubernetes/dns/blob/master/images/ dnsmasq/Dockerfile.cross https://github.com/kubernetes/dns/blob/master/images/dnsmasq/dnsmasq.conf Unless there is a strong reason why dnsmasq needs to run as root, I think it would be a better practice to run it as non-root. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#190>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVCLgS_32tnFhhzpaDwnJwiQMe2giks5tNkvpgaJpZM4RqU6I> .

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[redbaron]

/remove-lifecycle stale

[thockin]

@johnbelamaric can CoreDNS run as non-root?

[miekg]

[ Quoting <notifications@github.com> in "Re: [kubernetes/dns] kube-dns canno..." ]

@johnbelamaric can CoreDNS run as non-root?

yes: % ./coredns -dns.port=1043 .:1043 2018/04/29 20:28:15 [INFO] CoreDNS-1.1.2 2018/04/29 20:28:15 [INFO] linux/amd64, go1.10.1, CoreDNS-1.1.2 linux/amd64, go1.10.1,

[johnbelamaric]

yep, as @miekg said

[thockin]

We should give it CAP_NET_BIND and run as non-root by default, perhaps?

…

On Mon, Apr 30, 2018, 5:44 PM John Belamaric ***@***.***> wrote: yep, as @miekg <https://github.com/miekg> said — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#190 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVFvwekunK7wlGVQUQmsvrMGoL3QOks5ttzFxgaJpZM4RqU6I> .

[redbaron]

@thockin, apparently it requires setcap call on a file: moby/moby#8460

[johnbelamaric]

It’s a cluster IP anyway, why not just listen on port 5300 instead and set the targetPort?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.