The DNS egress router must run as privileged. With it being just an haproxy, it doesn't make much sense.

If I am not wrong, the biggest reason to need privileged is because of {{chroot}} option inherited from default file (https://github.com/openshift/images/blob/master/egress/dns-proxy/egress-dns-proxy.sh#L44). That option doesn't make much sense when we are already inside a container (hence why ingress controllers don't use it, for example).

So it may be worth exploring if this option can be removed and the DNS egress router can be run without requiring privileged mode, but maybe just CAP_NET_BIND_SERVICE

4.12.0

Always

1. Forget to set privileged mode in the container
2.
3.

Pod cannot start due to chroot setting. I need to run the container as privileged, which lowers security too much.

Run the container without being privileged, maybe adding CAP_NET_BIND_SERVICE.