[kata-dev] error occurs when kernel is 4.19.110-300.el7.x86_64/centos7.7.1908
bergwolf at hyper.sh
Mon Oct 25 04:19:32 UTC 2021
On 2021/10/23 13:12, David Gibson wrote:
> On Wed, Oct 20, 2021 at 07:46:41PM +0800, ylg wrote:
>> Hi, all:
>> if pod enables "securityContext: privileged: true", containerd faild
>> to start kata.
> "privileged" is ill-defined in the context of kata containers. One of
> the main uses of privileged containers is to manage things on the
> host, which is fundamentally incompatible with Kata's approach of
> running the container in a VM.
> There are some edge cases where privileged kata containers are used,
> but in general it's really not clear what permissions and abilities
> such a container should have.
> As a consequence, I'd recommend not attempting to use Kata for
> privileged containers.
It is just one use case of privileged containers. We still have other
cases like running FUSE daemons or nested containers (like dind or
kind), or anything that requires SYS_ADMIN capability in general. I
don't think we should just ask users to move away from privileged
containers with Kata.
If you think that `privileged` is not clearly defined with Kata, we can
make it clear together. Dropping it completely is not a wise choice imho.
Into something rich and strange.
More information about the kata-dev