Uploaded image for project: 'OpenShift Pipelines'
  1. OpenShift Pipelines
  2. SRVKP-2582

Use Kubernetes user namespaces for buildah pods

XMLWordPrintable

    • Use Kubernetes user namespaces for buildah pods
    • 6
    • False
    • Hide

      None

      Show
      None
    • False
    • OCPSTRAT-198Secure-by-default image builds
    • Done
    • OCPSTRAT-198 - Secure-by-default image builds
    • 0% To Do, 0% In Progress, 100% Done
    • Hide
      The new buildah-ns Tekton Task introduces Kubernetes user namespace isolation for Buildah builds.

      UID Mapping Behavior:

      Inside container → runs as UID 0 (root within the namespace)

      Outside container → mapped to a non-zero UID on the host

      This mapping creates an additional security boundary by allowing containers to appear as root inside their own namespace while running with reduced privileges on the host. As a result, potential container escape vulnerabilities are mitigated, and overall isolation is improved.
      Show
      The new buildah-ns Tekton Task introduces Kubernetes user namespace isolation for Buildah builds. UID Mapping Behavior: Inside container → runs as UID 0 (root within the namespace) Outside container → mapped to a non-zero UID on the host This mapping creates an additional security boundary by allowing containers to appear as root inside their own namespace while running with reduced privileges on the host. As a result, potential container escape vulnerabilities are mitigated, and overall isolation is improved.
    • Enhancement
    • Done

      Epic Goal

      OpenShift Pipelines uses Kubernetes user namespace instead of CRI-O user namespace in order to run buildah pods in the user namespaces

      Why is this important?

      To enable any authenticated user on OpenShift to run image builds through OpenShift Pipelines without requiring additional privileges for buildah pods that are not available to all authenticated users and all pods.

      Acceptance Criteria

      • Buildah pods in Pipelines (e.g. Buildah and S2I Tasks) run in the user namespace using the Kubernetes user namespaces
      • Buildah pods in Pipelines can run with the default service account and the user-namespace-aware equivalent of "restricted" SCC
      • Image builds with buildah functions without pipeline service account and pipeline-scc

              rh-ee-abghosh Abhishek Ghosh
              rh-ee-ssadeghi Siamak Sadeghianfar
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved:

                  Estimated:
                  Original Estimate - 6 minutes
                  6m
                  Remaining:
                  Remaining Estimate - 6 minutes
                  6m
                  Logged:
                  Time Spent - Not Specified
                  Not Specified