{"action":"opened","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/56374","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/56374/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/56374/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/56374/events","html_url":"https://github.com/kubernetes/kubernetes/issues/56374","id":276797602,"number":56374,"title":"Specified capabilities don't stick with docker + non-root container user","user":{"login":"danderson","id":1918,"avatar_url":"https://avatars0.githubusercontent.com/u/1918?v=4","gravatar_id":"","url":"https://api.github.com/users/danderson","html_url":"https://github.com/danderson","followers_url":"https://api.github.com/users/danderson/followers","following_url":"https://api.github.com/users/danderson/following{/other_user}","gists_url":"https://api.github.com/users/danderson/gists{/gist_id}","starred_url":"https://api.github.com/users/danderson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danderson/subscriptions","organizations_url":"https://api.github.com/users/danderson/orgs","repos_url":"https://api.github.com/users/danderson/repos","events_url":"https://api.github.com/users/danderson/events{/privacy}","received_events_url":"https://api.github.com/users/danderson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-26T04:02:16Z","updated_at":"2017-11-26T04:02:16Z","closed_at":null,"author_association":"NONE","body":"> /kind bug\r\n\r\n**What happened**:\r\n\r\nThe following takes place on a k8s 1.8.2 cluster.\r\n\r\nI have a Docker container image that wants to listen on :80, and specifies a non-root USER. To get this running, in my pod spec the container has the following security context:\r\n\r\n```yaml\r\nsecurityContext:\r\n    capabilities:\r\n        drop:\r\n        - all\r\n        add:\r\n        - NET_BIND_SERVICE\r\n    allowPrivilegeEscalation: false\r\n```\r\n\r\nWhen I schedule this pod on the cluster, the container fails to bind to :80 (permission denied), and goes into a crashloop. Note that Kubernetes did not complain that this configuration is in any way infeasible.\r\n\r\nThis would _apppear_ to be something that Docker is doing wrong, or that kubelet is mis-specifying to Docker. Peeking inside the pod with `kubectl exec`, `cat /proc/1/status` shows:\r\n\r\n```\r\nCapInh:\t0000000000000400\r\nCapPrm:\t0000000000000000\r\nCapEff:\t0000000000000000\r\nCapBnd:\t0000000000000400\r\nCapAmb:\t0000000000000000\r\nNoNewPrivs:\t1\r\n```\r\n\r\n0x400 is CAP_NET_BIND_SERVICE, so Docker is correctly setting the capability inherited and bounding sets, but CapPrm seems to be zeroed out by the change to a non-root user, which means the process loses the capability that Kubernetes attempted to grant.\r\n\r\n**What you expected to happen**:\r\n\r\nI expect the container to start and be able to bind to :80... Or at least I expect Kubernetes to log an event against the pod explaining that I'm holding it wrong.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\nDeploy this pod to a cluster using the default container runtime. You should see it crashlooping, with `kubectl logs bug-demo` showing that netcat is not allowed to bind to :80. If you comment out `runAsUser` and let the container binary run as root, it'll work fine.\r\n\r\n```yaml\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: bug-demo\r\nspec:\r\n  containers:\r\n  - name: netcat\r\n    image: danderson/bug-demo:latest\r\n    args:\r\n    - /bin/sh\r\n    - -c\r\n    - \"netcat -l -p 80\"\r\n    securityContext:\r\n      runAsUser: 65534\r\n      capabilities:\r\n        drop:\r\n        - all\r\n        add:\r\n        - NET_BIND_SERVICE\r\n      allowPrivilegeEscalation: false\r\n```\r\n\r\n**Anything else we need to know?**:\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`): 1.8.2 server, 1.8.1 kubectl\r\n- Cloud provider or hardware configuration: bare metal cluster, single node (master taint removed), set up with `kubeadm`.\r\n- OS (e.g. from /etc/os-release): Debian Testing\r\n- Kernel (e.g. `uname -a`): Linux pandora 4.12.0-2-amd64 #1 SMP Debian 4.12.13-1 (2017-09-19) x86_64 GNU/Linux\r\n- Install tools: `kubeadm`\r\n- Others:\r\n"}}
{"actor":{"display_login":"danderson"}}