allow running without securityContext.procMount=Unmasked (BuildKit v0.4) #221
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
AkihiroSuda
commented
Mar 15, 2019
When `/proc` is not mountable, img now automatically disables process sandbox (PID namespace isolation). Note that this allows build containers to `kill(2)` (and potentially `ptrace(2)` when seccomp is unavailable) the `img` process. To run `img` in a Docker container, you no longer need to specify `--privileged`, but you still need to specify `--security-opt seccomp=unconfined --security-opt apparmor=unconfined` (which are unconfined on Kubernetes by default). Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
So as to avoid Travis quota Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Codecov Report
@@ Coverage Diff @@
## master #221 +/- ##
=====================================
Coverage 0% 0%
=====================================
Files 14 14
Lines 768 777 +9
=====================================
- Misses 768 777 +9
Continue to review full report at Codecov.
|
|
@jessfraz could you take a look? |
|
Thanks!!! |
AkihiroSuda
added a commit
to AkihiroSuda/kaniko
that referenced
this pull request
Apr 13, 2019
Latest BuildKit/img no longer necessarily requires procMount to be unmasked, by not unsharing PID namespaces. The current drawback of BuildKit/img compared to kaniko is that BuildKit/img requires seccomp and AppArmor to be disabled so as to create nested containers. moby/buildkit#768 genuinetools/img#221 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
AkihiroSuda
added a commit
to AkihiroSuda/makisu
that referenced
this pull request
Apr 13, 2019
Latest BuildKit/img no longer necessarily requires procMount to be unmasked, by not unsharing PID namespaces. The current drawback of BuildKit/img compared to makisu is that BuildKit/img requires seccomp and AppArmor to be disabled so as to create nested containers. moby/buildkit#768 genuinetools/img#221 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
yiranwang52
pushed a commit
to uber-archive/makisu
that referenced
this pull request
Apr 13, 2019
Latest BuildKit/img no longer necessarily requires procMount to be unmasked, by not unsharing PID namespaces. The current drawback of BuildKit/img compared to makisu is that BuildKit/img requires seccomp and AppArmor to be disabled so as to create nested containers. moby/buildkit#768 genuinetools/img#221 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
sharifelgamal
pushed a commit
to GoogleContainerTools/kaniko
that referenced
this pull request
Apr 25, 2019
Latest BuildKit/img no longer necessarily requires procMount to be unmasked, by not unsharing PID namespaces. The current drawback of BuildKit/img compared to kaniko is that BuildKit/img requires seccomp and AppArmor to be disabled so as to create nested containers. moby/buildkit#768 genuinetools/img#221 Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When
/procis not mountable, img now automatically disables process sandbox (PID namespace isolation).Note that this allows build containers to
kill(2)(and potentiallyptrace(2)when seccomp is unavailable) theimgprocess.To run
imgin a Docker container, you no longer need to specify--privileged, but you still need to specify--security-opt seccomp=unconfined --security-opt apparmor=unconfined(which are unconfined on Kubernetes by default).