[kata-dev] error occurs when kernel is 4.19.110-300.el7.x86_64/centos7.7.1908

Peng Tao bergwolf at hyper.sh
Mon Oct 25 04:19:32 UTC 2021

On 2021/10/23 13:12, David Gibson wrote:
> On Wed, Oct 20, 2021 at 07:46:41PM +0800, ylg wrote:
>> Hi, all:
>> if pod enables "securityContext: privileged: true", containerd faild
>> to start kata.
> "privileged" is ill-defined in the context of kata containers.  One of
> the main uses of privileged containers is to manage things on the
> host, which is fundamentally incompatible with Kata's approach of
> running the container in a VM.
> There are some edge cases where privileged kata containers are used,
> but in general it's really not clear what permissions and abilities
> such a container should have.
> As a consequence, I'd recommend not attempting to use Kata for
> privileged containers.

It is just one use case of privileged containers. We still have other 
cases like running FUSE daemons or nested containers (like dind or 
kind), or anything that requires SYS_ADMIN capability in general. I 
don't think we should just ask users to move away from privileged 
containers with Kata.

If you think that `privileged` is not clearly defined with Kata, we can 
make it clear together. Dropping it completely is not a wise choice imho.

Into something rich and strange.

More information about the kata-dev mailing list