moby / moby/buildkit

buildkitd pod is failing on kubernetes cluster having PSP even after allowing unmasked ProcMounTypes

Open
#1,671 5 comments 0 reactions 1 assignee View on GitHub

@AkihiroSuda is already working on this.

Since Sep 4, 2020.

area/kubernetes area/rootless kind/question
Dominant language
Go
Stars
10.3k
Forks
1.5k
Avg merge
1d 23h
Merged PRs (30d)
48

Description

Hello!

I tried to deploy buildkitd in kubernetes cluster having below PSP applied, but it failed with error: [rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 10 [0 1000 1 1 100000 65536] failed: newuidmap: Could not set caps
: exit status 1
If I allow privilege escalation in PSP then it works fine.

spec:
allowPrivilegeEscalation: false
allowedCapabilities:

  • '*'
    allowedProcMountTypes:
  • Unmasked
    fsGroup:
    ranges:
    • max: 65535
      min: 1
      rule: MustRunAs
      hostIPC: true
      hostPID: true
      hostPorts:
  • max: 65535
    min: 0
    runAsUser:
    rule: RunAsAny
    seLinux:
    rule: RunAsAny
    supplementalGroups:
    rule: RunAsAny
    volumes:
  • '*'

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.