github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-06-28 16:27:50 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #452 from leoluk/patch-1

Browse Source 
docs: Clarify security boundaries in privileged mode
This commit is contained in:
James O. D. Hunt 2019-05-07 08:55:09 +01:00 committed by GitHub
commit 82afd0a6dc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Limitations.md
View File

@ -1,5 +1,5 @@
* [Overview](#overview) * [Overview](#overview)
* [Definiton of a limitation](#definiton-of-a-limitation) * [Definition of a limitation](#definiton-of-a-limitation)
* [Scope](#scope) * [Scope](#scope)
* [Contributing](#contributing) * [Contributing](#contributing)
* [Pending items](#pending-items) * [Pending items](#pending-items)
@ -44,7 +44,7 @@ launches each container within its own hardware isolated VM, and each VM has
its own kernel. Due to this higher degree of isolation, certain container its own kernel. Due to this higher degree of isolation, certain container
capabilities cannot be supported or are implicitly enabled through the VM. capabilities cannot be supported or are implicitly enabled through the VM.
# Definiton of a limitation # Definition of a limitation
The [Open Container Initiative](https://www.opencontainers.org/) The [Open Container Initiative](https://www.opencontainers.org/)
[Runtime Specification](https://github.com/opencontainers/runtime-spec) ("OCI spec") [Runtime Specification](https://github.com/opencontainers/runtime-spec) ("OCI spec")
@ -220,11 +220,15 @@ See more documentation at
Privileged support in Kata is essentially different from `runc` containers. Privileged support in Kata is essentially different from `runc` containers.
Kata does support `docker run --privileged` command, but in this case full access Kata does support `docker run --privileged` command, but in this case full access
to the guest VM is provided instead of the host. to the guest VM is provided in addition to some host access.
The container runs with elevated capabilities within the guest and is granted The container runs with elevated capabilities within the guest and is granted
access to guest devices instead of the host devices. access to guest devices instead of the host devices.
This is also true with using `securityContext privileged=true` with Kubernetes. This is also true with using `securityContext privileged=true` with Kubernetes.
The container may also be granted full access to a subset of host devices
(https://github.com/kata-containers/runtime/issues/1568).
# Miscellaneous # Miscellaneous
This section lists limitations where the possible solutions are uncertain. This section lists limitations where the possible solutions are uncertain.