Open Stack

On 2021/10/23 13:12, David Gibson wrote:
> On Wed, Oct 20, 2021 at 07:46:41PM +0800, ylg wrote:
>> Hi, all:
>>
>> if pod enables "securityContext: privileged: true", containerd faild
>> to start kata.
> 
> "privileged" is ill-defined in the context of kata containers.  One of
> the main uses of privileged containers is to manage things on the
> host, which is fundamentally incompatible with Kata's approach of
> running the container in a VM.
> 
> There are some edge cases where privileged kata containers are used,
> but in general it's really not clear what permissions and abilities
> such a container should have.
> 
> As a consequence, I'd recommend not attempting to use Kata for
> privileged containers.
> 

It is just one use case of privileged containers. We still have other 
cases like running FUSE daemons or nested containers (like dind or 
kind), or anything that requires SYS_ADMIN capability in general. I 
don't think we should just ask users to move away from privileged 
containers with Kata.

If you think that `privileged` is not clearly defined with Kata, we can 
make it clear together. Dropping it completely is not a wise choice imho.

Cheers,
Tao
-- 
Into something rich and strange.