Skip to content

upgrade pause image to 3.5 for non-root#5211

Merged
crosbymichael merged 1 commit intocontainerd:masterfrom
pacoxu:pause/3.5
Mar 18, 2021
Merged

upgrade pause image to 3.5 for non-root#5211
crosbymichael merged 1 commit intocontainerd:masterfrom
pacoxu:pause/3.5

Conversation

@pacoxu
Copy link
Copy Markdown
Contributor

@pacoxu pacoxu commented Mar 16, 2021

After kubernetes/k8s.io#1793 is promoted, update pause image in containerd

@k8s-ci-robot
Copy link
Copy Markdown

k8s-ci-robot commented Mar 16, 2021

Hi @pacoxu. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@pacoxu pacoxu mentioned this pull request Mar 16, 2021
Merged
@theopenlab-ci
Copy link
Copy Markdown

theopenlab-ci Bot commented Mar 16, 2021

Build succeeded.

@BenTheElder
Copy link
Copy Markdown
Contributor

BenTheElder commented Mar 16, 2021

cc @dims

@BenTheElder BenTheElder mentioned this pull request Mar 16, 2021
Merged
@dims
Copy link
Copy Markdown
Member

dims commented Mar 16, 2021

/ok-to-test

dims
dims approved these changes Mar 16, 2021
View reviewed changes
Copy link
Copy Markdown
Member

@dims dims left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

(in principle, lets wait for a couple of days before we merge)

Usually it's not that concerning, this time we have a new "feature":
https://github.com/kubernetes/kubernetes/pull/100292/files#diff-bfe97f538aa4fdf7f7d3aabe4d5ba4c134c1c05b0b1291b5f9b8f9f316c07571R1-R4

@pacoxu
Copy link
Copy Markdown
Contributor Author

pacoxu commented Mar 17, 2021

To move this forward, should we add a param pauseImageRunAsUser in containerd configuration files?

Then we can define a specified user in containerd.

Some users are using the k8s cluster in local env, and the pause image is from a private repo. The current behavior is based on the pause image user. If you use pause:3.5, it is default not-root. If you use pause:3.4.1, the default is root.

If we can force the RunAsUser in containerd config, it would restrict user to run pause as non-root.

@crosbymichael crosbymichael merged commit 3f98a6d into containerd:master Mar 18, 2021
@BenTheElder
Copy link
Copy Markdown
Contributor

BenTheElder commented Mar 18, 2021

FYI upstream opted not to ship it in dockershim etc. until the next release cycle kubernetes/kubernetes#100292

@pacoxu pacoxu mentioned this pull request Mar 29, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dims dims dims approved these changes

@crosbymichael crosbymichael crosbymichael approved these changes

Assignees

No one assigned

Labels

ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@pacoxu @k8s-ci-robot @BenTheElder @dims @crosbymichael