What capabilites are required to restart a process of another container (without being root)?

user_5580578 0
Viewed 92

What additional capabilities does a sidecar container need so that it can restart a process in another container without being root?

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  shareProcessNamespace: true
  containers:
  - name: nginx
    image: nginx
    securityContext:
      privileged: false
      allowPrivilegeEscalation: false
  - name: shell
    image: busybox:1.28
    securityContext:
      capabilities:
        add:
        - SYS_PTRACE
      runAsUser: 12345
      runAsGroup: 12345
      privileged: false
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
    stdin: true
    tty: true

If you run the shell container as root, you can have the nginx process restarted from the second container with no problem. However, if I run the container as non-root like in the pod.yaml above, I get an error message saying I'm not allowed to restart the process.

kubectl apply -f pod.yaml
kubectl attach -it nginx -c shell
# in the shell container
/ $ ps
PID   USER     TIME  COMMAND
 1 65535     0:00 /pause
 7 root      0:00 nginx: master process nginx -g daemon off;

/ $ kill -HUP 7
sh: can't kill pid 7: Operation not permitted

The two services just provide a simple example to describe the problem. My plan is that I want to restart the process in the other container from a sidecar container (here the shell container) if a configuration (from a configmap) changes that this process only gets at the beginning.

kubernetes
1 Answers

You can get a list of the current capabilities from your container to create a copy from them and apply them in your yaml file. This document describes how to use the following command to get this list.

$sudo docker run --rm -it --cap-drop $CAP alpine sh

Also, I noticed you need to add the following line below the securityContext:

runAsNonRoot:true

In addition, please note that when you are working with a non root user in Nginx, you will need to follow these recommendations, and finally you can find the capability full list in this link.

user_178941040
Related