Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] Make /proc/sys read-only with carve-outs for some sysctls #3518

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[WIP] Make /proc/sys read-only with carve-outs for some sysctls #3518

wants to merge 1 commit into from

Commits on Feb 13, 2024

  1. Make /proc/sys read-only with carve-outs for some sysctls 

    This mounts a read-write version of /proc and /sys under /kind/private,
which allows bind mounting and also makes use cases that need an
unmasked proc or sys possible.

/proc/sys is bind mounted read only per the systemd container
interface[1]. Then some sysctls are made writable again by bind mounting
across from the private /proc which was mounted.

This may cause issues for privileged daemonsets which set sysctls which
aren't namespaced (this may work anyway as often they set them to the
same value on multiple nodes). That can be worked around by adding
additional bind mounts via docker exec, making it clear kind can't
support such interfaces and they might leak from the container.

[1]: https://systemd.io/CONTAINER_INTERFACE/
    @dgl
    dgl committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    9709d01 View commit details
    Browse the repository at this point in the history