Support isolated rootless builder jobs on Kind without relaxing worker security
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 8/100
- Issue 类型
- 缺陷
- 描述清晰度
- 需要澄清
- 活跃度
- 活跃
- 技术栈
- docker, kubernetes, linux
- 领域
- devops, infrastructure, security
调研方向
The payload names no repository files, so start from the reproduction: a minimal BusyBox pod with hostUsers: false on Kind 0.30.0 that fails with the sysfs mount error. Read the linked kind issue #3436 and the two backport PRs to see what is already decided. Done means a valid build completes and pushes to the lab registry while the worker security settings stay enabled, which requires maintainer design input first.
由索引模型根据 Issue 内容生成。
描述
The 0.9.0 builder security backport retains Kubernetes user namespaces (hostUsers: false), a non-privileged rootless worker, no service-account token and the BuildKit process sandbox. Kind must support legitimate builds without disabling those protections.
In an isolated lab with Kind 0.30.0, Kubernetes 1.33.1, containerd 2.1.1 and Linux 6.8.0-146, a valid build is accepted but fails before the worker starts: mounting sysfs ... operation not permitted. A minimal BusyBox pod with hostUsers: false reproduces it; the equivalent ordinary pod succeeds.
Related upstream investigation: https://github.com/kubernetes-sigs/kind/issues/3436.
An initial read-only sysfs mount inside the Kind node clears the sandbox mount failure and exposes a second error: /kind/bin/mount-product-files.sh: permission denied; the node's /kind directory is mode 0644. This is still under test, not a completed compatibility fix.
Acceptance: a valid base-image and dependency build completes and pushes to the authenticated lab registry; the resulting image can run an action; malformed and cross-tenant targets remain rejected; worker user namespaces, non-privileged mode, token exclusion and process sandbox remain enabled. Node setup must be repeatable and survive node restart without granting workers access to the host Docker socket or host paths.
Related security backports:
- 主要语言
- Python
- 星标
- 576
- 派生
- 29
- 平均合并
- 3 天 39 分钟
- 30 天内合并 PR
- 5
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
apache/openserverless 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 85/100
apache/openserverless#269 ·
-
难度 2/5 1-3 小时 新手友好度 84/100
apache/openserverless#267 ·
-
难度 4/5 1-2 天 新手友好度 42/100
apache/openserverless#271 · 4 条评论 ·
-
难度 5/5 一周以上 新手友好度 35/100
apache/openserverless#268 ·
-
enhancement
难度 5/5 一周以上 新手友好度 25/100
apache/openserverless#215 ·
查看 apache/openserverless 的全部 Issue
相似的 Issue
-
Path subtraction removes repeated suffix characters instead of one suffix可能已有人在做 @Gwerdonatus 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
joke2k/django-environ#671 ·
-
good first issue help wanted windows
难度 2/5 1-3 小时 新手友好度 80/100
-
test_pgbouncer deploys the server under test from Charmhub instead of the local build (track/1.31)未关闭bug
难度 2/5 1-3 小时 新手友好度 68/100
canonical/temporal-k8s-operator#195 · 1 条评论 ·
维护者通常 4 天内回复
-
`burr` fails to start when the Python path has a space in it可能已有人在做 @enekoreto 今天认领。 未关闭status/needs-triage
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 5 天内回复
-
device support request
难度 2/5 1-3 小时 新手友好度 68/100
zigpy/zha-device-handlers#5461 ·
维护者通常 4 天内回复