Support isolated rootless builder jobs on Kind without relaxing worker security
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 8/100
- Issue 類型
- 缺陷
- 描述清晰度
- 需要釐清
- 活躍度
- 活躍
- 技術堆疊
- docker, kubernetes, linux
- 領域
- devops, infrastructure, security
研究方向
The payload names no repository files, so start from the reproduction: a minimal BusyBox pod with hostUsers: false on Kind 0.30.0 that fails with the sysfs mount error. Read the linked kind issue #3436 and the two backport PRs to see what is already decided. Done means a valid build completes and pushes to the lab registry while the worker security settings stay enabled, which requires maintainer design input first.
由索引模型根據 Issue 內容生成。
描述
The 0.9.0 builder security backport retains Kubernetes user namespaces (hostUsers: false), a non-privileged rootless worker, no service-account token and the BuildKit process sandbox. Kind must support legitimate builds without disabling those protections.
In an isolated lab with Kind 0.30.0, Kubernetes 1.33.1, containerd 2.1.1 and Linux 6.8.0-146, a valid build is accepted but fails before the worker starts: mounting sysfs ... operation not permitted. A minimal BusyBox pod with hostUsers: false reproduces it; the equivalent ordinary pod succeeds.
Related upstream investigation: https://github.com/kubernetes-sigs/kind/issues/3436.
An initial read-only sysfs mount inside the Kind node clears the sandbox mount failure and exposes a second error: /kind/bin/mount-product-files.sh: permission denied; the node's /kind directory is mode 0644. This is still under test, not a completed compatibility fix.
Acceptance: a valid base-image and dependency build completes and pushes to the authenticated lab registry; the resulting image can run an action; malformed and cross-tenant targets remain rejected; worker user namespaces, non-privileged mode, token exclusion and process sandbox remain enabled. Node setup must be repeatable and survive node restart without granting workers access to the host Docker socket or host paths.
Related security backports:
- 主要語言
- Python
- 星號
- 576
- 分支
- 29
- 平均合併
- 3 天 39 分鐘
- 30 天內合併 PR
- 5
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
apache/openserverless 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 85/100
apache/openserverless#269 ·
-
難度 2/5 1-3 小時 新手友好度 84/100
apache/openserverless#267 ·
-
難度 4/5 1-2 天 新手友好度 42/100
apache/openserverless#271 · 7 則留言 ·
-
難度 5/5 一週以上 新手友好度 35/100
apache/openserverless#268 ·
-
enhancement
難度 5/5 一週以上 新手友好度 25/100
apache/openserverless#215 ·
查看 apache/openserverless 的全部 Issue
相似的 Issue
-
難度 1/5 1 小時以內 新手友好度 88/100
-
難度 2/5 1-3 小時 新手友好度 72/100
aws-samples/sample-per-model-bedrock#261 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 65/100
pwncollege/dojo#1188 ·
維護者通常 1 天內回覆
-
bug launcher packaging
難度 1/5 1 小時以內 新手友好度 88/100
tenstorrent/tt-studio#1426 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
python-attrs/cattrs#796 ·
維護者通常 1 天內回覆