0

I'm running minikube on a MacOSX host with a VirtualBox hypervisor. It shares a folder (/Users) with the host. What for and how safe is this, safe enough to run my cluster online?

I guess it is deifficult to escape a container and then a pod and then the VM, but I got in there simply with minikube ssh and, I wasn't aware of the shared folder and that the shell allows me to explore the host.

Improve this question

1 Answer 1

Reset to default
0

No, it is not safe. Imagine having a pod deployed with a container image that was built with a USER daemon directive in the Dockerfile, which makes the container run under the daemon user. What if an attacker gets access to your image registry and pushes a different image under the same tag? The attacker’s image is configured to run as the root user. When Kubernetes schedules a new instance of your pod, the Kubelet will download the attacker’s image and run whatever code they put into it. Although containers are mostly isolated from the host system, running their processes as root is still considered a bad practice. For example, when a host directory is mounted into the container, if the process running in the container is running as root, it has full access to the mounted directory, whereas if it’s running as non-root, it won’t. To prevent the attack scenario described previously, you can specify that the pod’s container needs to run as a non-root user, as shown in the following listing.

apiVersion: v1
kind: Pod
metadata:
  name: pod-run-as-non-root
spec:
  containers:
  - name: main
    image: alpine
    command: ["/bin/sleep", "999999"]
    securityContext:
      runAsNonRoot: true
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .