1

We've got a docker container running with a mount to /var/run/docker. It's a daemonset pulling an image every day to the host the pod is running on.

containers:
      - name: updater
        image: docker #official docker image
        volumeMounts:
        - name: dockersock
          mountPath: /var/run/docker.sock
        securityContext:
          capabilities:
            drop:
              - all
            add:
              - SYS_ADMIN

It works but the pods are running as SYS_ADMIN.

https://man7.org/linux/man-pages/man7/capabilities.7.html

What is the minimum required capability to be able to pull images through /var/run/docker.sock on the host from a pod?

1
  • If you don't add CAP_SYS_ADMIN, what fails?
    – larsks
    Apr 28 at 12:45

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.