Skip to content

Commit a39f114

Browse files
samuelkarpk8s-infra-cherrypick-robot
samuelkarp
authored and
k8s-infra-cherrypick-robot
committed
docs: include note about unprivileged sysctls
We changed the default setting for `enable_unprivileged_ports` and `enable_unprivileged_icmp` in the CRI plugin in #9348, but missed including this change in the release notes. Signed-off-by: Samuel Karp <[email protected]>
1 parent a7f1ff9 commit a39f114

2 files changed

Lines changed: 4 additions & 3 deletions

File tree

‎docs/containerd-2.0.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@ This features needs [runc](https://github.com/opencontainers/runc) v1.2.0 or lat
8787

8888
The CRI plugin now supports [recursive read-only mounts](https://kubernetes.io/docs/concepts/storage/volumes/#read-only-mounts) so as to prohibit accidentally having writable submounts.
8989

90+
### Unprivileged ports and ICMP by default for CRI
91+
92+
The CRI plugin now enables `net.ipv4.ip_unprivileged-port-start=0` and `net.ipv4.ping_group_range=0 2147483647` for containers that do not use the host network namespace or user namespaces. This enables containers to bind to ports below 1024 without granting `CAP_NET_BIND_SERVICE` and to run `ping` without `CAP_NET_RAW`. This default behavior change can be reverted by setting the `enable_unprivileged_ports` and `enable_unprivileged_icmp` options to `false` in the CRI plugin configuration.
93+
9094
### Deprecation warnings can now be discovered via the Introspection API
9195

9296
Deprecations warnings have been added to the `ServerResponse` for the introspection service (`/containerd.services.introspection.v1.Introspection/Server`) and to the `ctr` tool via `ctr deprecation list`.

‎internal/cri/config/config.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -375,13 +375,10 @@ type RuntimeConfig struct {
375375
// EnableUnprivilegedPorts configures net.ipv4.ip_unprivileged_port_start=0
376376
// for all containers which are not using host network
377377
// and if it is not overwritten by PodSandboxConfig
378-
// Note that currently default is set to disabled but target change it in future, see:
379-
// https://github.com/kubernetes/kubernetes/issues/102612
380378
EnableUnprivilegedPorts bool `toml:"enable_unprivileged_ports" json:"enableUnprivilegedPorts"`
381379
// EnableUnprivilegedICMP configures net.ipv4.ping_group_range="0 2147483647"
382380
// for all containers which are not using host network, are not running in user namespace
383381
// and if it is not overwritten by PodSandboxConfig
384-
// Note that currently default is set to disabled but target change it in future together with EnableUnprivilegedPorts
385382
EnableUnprivilegedICMP bool `toml:"enable_unprivileged_icmp" json:"enableUnprivilegedICMP"`
386383
// EnableCDI indicates to enable injection of the Container Device Interface Specifications
387384
// into the OCI config

0 commit comments

Comments
 (0)