On Thu, 2021-12-09 at 07:22 +0000, Denis Semakin wrote: > Hi. > My question won't be about capabilities. I'm wondering how IMA-ns > which is associated with USER-ns and is created during USER-ns > creation would be used by some namespaces orchestration systems, e.g. > Kubernetes? Orchestration systems that don't adopt the user namespace can't really run containers requiring admin correctly without giving them root minus some capabilities, which is rather unsafe, so the expectation is that they'll all figure it out eventually for security reasons. > .. It seems that it can be run without any user namespaces... > Their community just discuss this opportunity to support User > namespaces. (see https://github.com/kubernetes/enhancements/pull/2101 > ) Looks like currently IMA-ns will not be applicable for Kubernetes. Well, lets just say it adds one more reason to get kubernetes to finally run rootless privileged containers correctly ... James
