OSDOCS 16556 Linux User Namespace ID-mapped mount information #100433
Conversation
openshift-ci
bot
added
the
size/XS
mburke5678
force-pushed
the
node-user-ns-known-issue
branch
from
b0ca24c to
f69ac7f
Compare
|
🤖 Fri Oct 17 12:39:39 - Prow CI generated the docs preview: |
mburke5678
changed the title
|
@haircommander PTAL |
|
LGTM |
mburke5678
force-pushed
the
node-user-ns-known-issue
branch
from
f69ac7f to
fc327f4
Compare
|
@lyman9966 Peter Hunt suggested you could review this PR for us. We are hoping to get this in for 4.20. Thank you! |
|
/lgtm |
mburke5678
force-pushed
the
node-user-ns-known-issue
branch
from
fc327f4 to
a8198fb
Compare
|
New changes are detected. LGTM label has been removed. |
mburke5678
changed the title
| @@ -12,6 +12,13 @@ By default, a container runs in the host user namespace. Running a container in | |||
|
|
|||
| Running containers in individual user namespaces can mitigate container breakouts and several other vulnerabilities that a compromised container can pose to other pods and the node itself. | |||
|
|
|||
| When running a pod in an isolated user namespace, the UID/GID inside a pod container no longer matches the UID/GID on the host. In order for file system ownership to work correctly, the Linux kernel uses ID-mapped mounts, which translate user IDs between the container and the host at the virtual file system (VFS) layer. | |||
There was a problem hiding this comment.
🤖 [error] Vale.Terms: Use 'VFs?' instead of 'VFS'.
mburke5678
added
the
merge-review-needed
|
@mburke5678: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
mburke5678
changed the title
xenolinux
added
merge-review-in-progress
xenolinux
removed
the
merge-review-in-progress
|
/cherrypick enterprise-4.20 |
|
@xenolinux: new pull request created: #100733 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
7 participants
https://issues.redhat.com/browse/OSDOCS-16556
From thread in Slack.
Link to docs preview:
Running pods in Linux user namespaces -- New paragraph 4 and Note.
SME review:
QE review: