On 2021/10/23 13:12, David Gibson wrote:
On Wed, Oct 20, 2021 at 07:46:41PM +0800, ylg wrote:
Hi, all:
if pod enables "securityContext: privileged: true", containerd faild to start kata.
"privileged" is ill-defined in the context of kata containers. One of the main uses of privileged containers is to manage things on the host, which is fundamentally incompatible with Kata's approach of running the container in a VM.
There are some edge cases where privileged kata containers are used, but in general it's really not clear what permissions and abilities such a container should have.
As a consequence, I'd recommend not attempting to use Kata for privileged containers.
It is just one use case of privileged containers. We still have other cases like running FUSE daemons or nested containers (like dind or kind), or anything that requires SYS_ADMIN capability in general. I don't think we should just ask users to move away from privileged containers with Kata. If you think that `privileged` is not clearly defined with Kata, we can make it clear together. Dropping it completely is not a wise choice imho. Cheers, Tao -- Into something rich and strange.