Uploaded image for project: 'OpenShift Node'
  1. OpenShift Node
  2. OCPNODE-3024

Add ProcMount option GA in 4.20

XMLWordPrintable

    • support proc Mount with user NS
    • Product / Portfolio Work
    • OCPSTRAT-1654GA User Name Space in OpenShift 4.20
    • 0% To Do, 0% In Progress, 100% Done
    • False
    • Hide

      None

      Show
      None
    • False
    • Not Selected
    • S
    • None
    • None
    • Program Call

      Background

      Currently the way docker and most other container runtimes work is by masking|
      and setting as read-only certain paths in `/proc`. This is to prevent data|
      from being exposed into a container that should not be. However, there are|
      certain use-cases where it is necessary to turn this off.

      Motivation

      For end-users who would like to run unprivileged containers using user namespaces
      nested inside CRI containers, we need an option to have a `ProcMount`. That is,
      we need an option to designate explicitly turn off masking and setting
      read-only of paths so that we can
      mount `/proc` in the nested container as an unprivileged user.

              pehunt@redhat.com Peter Hunt
              gausingh@redhat.com Gaurav Singh
              None
              None
              None
              Matthew Werner Matthew Werner
              Derrick Ornelas Derrick Ornelas
              Votes:
              1 Vote for this issue
              Watchers:
              12 Start watching this issue

                Created:
                Updated:
                Resolved: