0

Docker daemon has to run in root mode which brings up security discussions.

How is this with Kubernetes daemon - can it run not as root?

Note: both of these products allow you to reduce the scope of kernel capabilities allowed for containers but this is not the question.

Improve this question
6
  • How does the the production k8s cluster look like? On what platform does it run? How has it been created?
    – 030
    Sep 21, 2017 at 10:12
  • I want to design and build a prototypic prod one and play with it :)
    – Ta Mu
    Sep 21, 2017 at 11:19
  • K8S is just sitting on top of docker, so there's still a docker daemon running (as root). If you're talking about kubelet it has to run as root as well, at least so it can open the low ports (80, 443) on the node if you end up defining a service with a node port.
    – Tensibai
    Sep 21, 2017 at 13:44
  • Hmm I thought k8s has been there before Docker?
    – Ta Mu
    Sep 21, 2017 at 13:56
  • As community user brings this up I may answer previous comment: I didn't dig into k8s and docker history, but that's irrelevant to answer the question, k8s just control docker (if you prefer that wording) and as such I still have no idea what you're talking about with 'kubernetes daemon', are you asking about the container manager or kubelet service ?
    – Tensibai
    Nov 20, 2017 at 13:13

1 Answer 1

Reset to default
1

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/

With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.

In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.

There is an open issue:

https://github.com/kubernetes/kubernetes/issues/7961

Improve this answer
1
  • this is not exactly answer to my question - kernel capabilities management is available for Docker as well.
    – Ta Mu
    Sep 21, 2017 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.