Configure a security context for a pod or container - Elastic Container Instance

Background information

A security context defines the privilege and access control settings for a pod or a container, including Discretionary Access Control, SELinux, and Linux capabilities. For more information, see Security Context.

Kubernetes provides two ways to configure a security context:

Method	Scope	Supported features
Pod security context	Pod level. Applies to all containers and volumes in the pod.	Modifies `sysctl` parameters and `runAsUser`.
Container security context	Container level. Applies to a specified container.	Modifies `runAsUser`, `capabilities`, and other parameters.

Configure a Pod security context

Configuration

In Linux, use the sysctl interface to modify runtime kernel parameters. To view the kernel parameters of an elastic container instance, run the following command. For more information, see sysctl.sh.

sysctl -a

At the pod level, you can configure a security context to modify sysctl parameters and runAsUser.

Warning

To avoid compromising the stability of the operating system, change sysctl parameters only after you fully understand the impact of the changes. For more information, see sysctl.

ECI currently supports modifying the following sysctl parameters:

kernel.shm*
kernel.msg*
kernel.sem
fs.mqueue.*
net.* (except for net.ipv4.tcp_syncookies)
vm.min_free_kbytes

When you modify the value of vm.min_free_kbytes, it should not exceed 20% of the total memory.

Important

To modify host-level sysctl parameters other than those listed above, submit a ticket. After your request is approved, add the annotation k8s.aliyun.com/eci-host-sysctls: '[{"name":"xxx", "value": "vvv"}]' to the pod to modify the sysctl parameters.

Example

The following YAML example modifies net.core.somaxconn and kernel.msgmax:

apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
  labels: 
    alibabacloud.com/eci: "true"
spec:
  securityContext:
    sysctls:
    - name: net.core.somaxconn
      value: "1024"
    - name: kernel.msgmax
      value: "65536"
  containers:
  - name: busybox
    image: registry.cn-shanghai.aliyuncs.com/eci_open/busybox:1.30
    command: [ "sh", "-c", "sleep 12000" ]

Configure a Container security context

Configuration

At the container level, you can set a security context for individual containers.

Important

If a parameter, such as runAsUser, is set in both a Pod security context and a Container security context, the container-level setting takes precedence.

The following table describes the parameters that ECI supports.

Supported parameters	Description
`runAsUser`	Specifies the user ID (UID) used to run the container. This parameter overrides the `USER` instruction in the Dockerfile.
`runAsGroup`	Specifies the primary group ID (GID) for all processes within the container.
`runAsNonRoot`	If `true`, the container must run as a non-root user. The default is `false`.
`privileged`	Specifies whether to run the container in privileged mode. Set to `true` to enable privileged mode. The default value is `false`. Note The privileged container feature is in private preview. To use this feature, submit a ticket.
`capabilities`	Grants specific permissions to container processes. For more information, see Linux capabilities. You can configure the following permissions: `AUDIT_WRITE` `CHOWN` `DAC_OVERRIDE` `FSETID` `FOWNER` `KILL` `MKNOD` `NET_ADMIN` `NET_BIND_SERVICE` `NET_RAW` `SETGID` `SETUID` `SETFCAP` `SETPCAP` `SYS_CHROOT` `SYS_PTRACE` `SYS_RAWIO` Note `SYS_RAWIO` is not supported by default. To use this permission, submit a ticket.

The following table describes parameters that are not configurable and their default values.

Unsupported parameters	Description
`AllowedProcMountTypes`	Specifies the proc mount types for the container. The default value is `DefaultProcMount`.
`readOnlyRootFilesystem`	Specifies whether the container's root filesystem is read-only. The default value is `true`.

Example

By default, containers do not have the NET_ADMIN capability. As a result, performing network-related operations in a container returns an error.

/ # ip route list
default via 172.1xxx3 dev eth0  src 172.xxx02  metric 1024
172.1xxx24 dev eth0 scope link  src 172.xxx02
172.1xxx3 dev eth0 scope link  src 172.1xxx2  metric 1024
/ # ip route delete 17xxx3
ip: RTNETLINK answers: Operation not permitted

To add the NET_ADMIN capability, configure a security context for the container and set the capabilities parameter. The following YAML provides an example:

apiVersion: v1
kind: Pod
metadata:
  name: net-admin-example
  labels: 
    alibabacloud.com/eci: "true"
spec:
  containers:
  - name: busybox
    image: registry.cn-shanghai.aliyuncs.com/eci_open/busybox:1.30
    command: ["sh", "-c", "sleep 12000"]
    securityContext:
      capabilities:
        add: ["NET_ADMIN"]

After re-creating the ECI pod, you can perform network-related operations in the container.

/ # ip route list
default via 172.1xxx3 dev eth0   src 172.xxx              metric 1024
172.1xxx24 dev eth0 scope link  src 172.xxx
172.1xxx3 dev eth0 scope link  src 172.1xxx              metric 1024
/ # ip route delete 172.1xxx3
/ # ip route list
default via 172.1xxx3 dev eth0   src 172.xxx              metric 1024
172.1xxx24 dev eth0 scope link  src 172.xxx
/ #