0

Docker daemon has to run in root mode which brings up security discussions.

How is this with Kubernetes daemon - can it run not as root?

Note: both of these products allow you to reduce the scope of kernel capabilities allowed for containers but this is not the question.

  • How does the the production k8s cluster look like? On what platform does it run? How has it been created? – 030 Sep 21 '17 at 10:12
  • I want to design and build a prototypic prod one and play with it :) – Peter Sep 21 '17 at 11:19
  • K8S is just sitting on top of docker, so there's still a docker daemon running (as root). If you're talking about kubelet it has to run as root as well, at least so it can open the low ports (80, 443) on the node if you end up defining a service with a node port. – Tensibai Sep 21 '17 at 13:44
  • Hmm I thought k8s has been there before Docker? – Peter Sep 21 '17 at 13:56
  • As community user brings this up I may answer previous comment: I didn't dig into k8s and docker history, but that's irrelevant to answer the question, k8s just control docker (if you prefer that wording) and as such I still have no idea what you're talking about with 'kubernetes daemon', are you asking about the container manager or kubelet service ? – Tensibai Nov 20 '17 at 13:13
1

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/

With Linux capabilities, you can grant certain privileges to a process without granting all the privileges of the root user. To add or remove Linux capabilities for a Container, include the capabilities field in the securityContext section of the Container manifest.

In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.

There is an open issue:

https://github.com/kubernetes/kubernetes/issues/7961

  • this is not exactly answer to my question - kernel capabilities management is available for Docker as well. – Peter Sep 21 '17 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.