2

Linux capabilities is applied to an executable. If I add capabilities to a container, what does it mean? This is my container securityContext:

securityContext:
  runAsUser: 1008
  capabilities:
    add:
      - NET_ADMIN
      - NET_RAW

But my task can't create raw socket. So shall I apply capabilities to the executable when packing docker image?

Malgorzata
  • 6,409
  • 1
  • 10
  • 27
Mr Pang
  • 1,083
  • 1
  • 8
  • 20
  • Can you try to delete runAsUser: 1008 line from the code ? See examples: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container – Malgorzata Dec 17 '20 at 11:30
  • @Malgorzata Yes. I found capabilities only works with root account. – Mr Pang Dec 18 '20 at 00:45

1 Answers1

1

As I have adviced you in comment section, I am posting it as an answer:

Starting with kernel 2.2, Linux has divided privileged processes’ privileges into distinct units, known as capabilities. These distinct units/privileges can be independently assigned and enabled for unprivileged processes introducing root privileges to them. Kubernetes users can use Linux capabilities to grant certain privileges to a process without giving it all privileges of the root user. This is helpful for improving container isolation from the host since containers no longer need to write as root — you can just grant certain root privileges to them and that’s it.

See: linux-cap-kubernetes.

Part of your code under container section should look like this:

securityContext:  
  capabilities:  
    add:
      - NET_ADMIN
      - NET_RAW

To run some capabilities (in your case perform various network-related operations) you have to run container as root. See example: capabilities-securitycontext.

Read more: linux-capabilities-securityContext.

Malgorzata
  • 6,409
  • 1
  • 10
  • 27
  • My test result shows that runAsUser+capabilities didn't work. But I can't find any description. So I am not sure if this is a bug or not – Mr Pang Dec 21 '20 at 02:00
  • To run some capabilities (in your case perform various network-related operations) you have to run container as root - https://stackoverflow.com/questions/61616892/sys-time-capability-now-working-in-kubernetes. I have edited my answer, take a look. – Malgorzata Dec 30 '20 at 10:29