Capabilities checking not working in kubernetes pod with shareProcessNamespace enabled
Opened this issue · 3 comments
mxmdt3 commented
In entrypoint /docker-entrypoint.sh, capabilities are checked on process with PID 1 with 'getpcaps 1'. However when running in a kubernetespod with shareProcessNamespace enabled (for log rotating purposes), the running process does not hold PID 1.
Could you check against current PID instead of PID 1?
Thanks
jasonish commented
It looks like chaning getpcaps 1 to getpcaps 0 is enough, as that uses the current process. Sound OK to you?
mxmdt3 commented
It sounds good to me
jasonish commented
I've pushed new images with this change.