Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support to containerRunOptions for --cap-drop #389

Open
ddl-ebrown opened this issue Oct 24, 2023 · 0 comments · May be fixed by #390
Open

Add support to containerRunOptions for --cap-drop #389

ddl-ebrown opened this issue Oct 24, 2023 · 0 comments · May be fixed by #390

Comments

@ddl-ebrown
Copy link

For security reasons, it's often desirable to drop all linux capabilities when running containers in Kubernetes. However, there is currently only a way to add capabilities for tests and no way to drop them.

As seen in, #327, support was only added for --cap-add

--cap-drop can similarly remove default capabilities - see https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
ddl-ebrown added a commit to ddl-ebrown/container-structure-test that referenced this issue Oct 24, 2023
@ddl-ebrown
Add support for --cap-drop
7af0286 
 - closes GoogleContainerTools#389
@ddl-ebrown ddl-ebrown linked a pull request Oct 24, 2023 that will close this issue
Open
ddl-ebrown added a commit to ddl-ebrown/container-structure-test that referenced this issue Oct 24, 2023
@ddl-ebrown
Add support for --cap-drop
b109714 
 - Support for --cap-add was added as part of
   GoogleContainerTools#327

 - This rounds out the feature set to also include support for
   --cap-drop

 - Updates tests to drop "chown" capability and verify doing so works

 - closes GoogleContainerTools#389
ddl-ebrown added a commit to ddl-ebrown/container-structure-test that referenced this issue Feb 29, 2024
@ddl-ebrown
Add support for --cap-drop
e3c9a68 
 - Support for --cap-add was added as part of
   GoogleContainerTools#327

 - This rounds out the feature set to also include support for
   --cap-drop

 - Updates tests to drop "chown" capability and verify doing so works

 - closes GoogleContainerTools#389
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: Add support for --cap-drop ddl-ebrown/container-structure-test
1 participant
@ddl-ebrown