We've got a docker container running with a mount to /var/run/docker. It's a daemonset pulling an image every day to the host the pod is running on.
containers: - name: updater image: docker #official docker image volumeMounts: - name: dockersock mountPath: /var/run/docker.sock securityContext: capabilities: drop: - all add: - SYS_ADMIN
It works but the pods are running as SYS_ADMIN.
What is the minimum required capability to be able to pull images through /var/run/docker.sock on the host from a pod?