Fix GPU security context, switch to ghcr.io #50
Conversation
Signed-off-by: Alexey Fomenko <[email protected]>
| allowPrivilegeEscalation: false | ||
| capabilities: | ||
| drop: ["ALL"] | ||
| readOnlyRootFilesystem: true |
There was a problem hiding this comment.
While allowPrivilegeEscalation is no-op (always true) when privileged mode is used, according to docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#securitycontext-v1-core
So are pretty much all the rest of these security settings no-ops with it, although that's not explicitly documented.
While it would be good to be able to restrict privileged mode with the other settings to just get (write) access to all host devices... Based on look at CRI-O & containerd code, container engines actually ignore the other security context restrictions when privileged mode is used.
There was a problem hiding this comment.
Ah, this change is because API server does not accept conflicting (privileged vs. escalation) setup for this particular security item => I wonder why API server does not complain about other things that are not true with privileged mode...
2 participants
No description provided.