Open Stack

On Wed, Oct 20, 2021 at 07:46:41PM +0800, ylg wrote:
> Hi, all:
> 
> if pod enables "securityContext: privileged: true", containerd faild
> to start kata.

"privileged" is ill-defined in the context of kata containers.  One of
the main uses of privileged containers is to manage things on the
host, which is fundamentally incompatible with Kata's approach of
running the container in a VM.

There are some edge cases where privileged kata containers are used,
but in general it's really not clear what permissions and abilities
such a container should have.

As a consequence, I'd recommend not attempting to use Kata for
privileged containers.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20211023/6f5a435b/attachment.sig>