I deploy Blocky in Kubernetes and always try to comply with Restricted profile of <a h

Release image without capabilities set about blocky HOT 3 OPEN

zc-devs commented on August 17, 2024

Release image without capabilities set

from blocky.

Comments (3)

SISheogorath commented on August 17, 2024

You can run blocky with PSS restrict. PSS restricted allows to add NET_BIND_SERVICE.

This is how I run blocky in a Namespace with PSS restricted version v1.26: https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/-/blob/37b991bc0f7f4955773bce1df3ef5a0b6ce6cd0f/apps/k8s01/dns/dns.yaml

from blocky.

zc-devs commented on August 17, 2024

It requires to drop all capabilities, except NET_BIND_SERVICE

I supposed, that config below should work

          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE

However, the point is I do not need privileged ports and want to run without NET_BIND_SERVICE capability. But as this capability is set on executable, I have to add NET_BIND_SERVICE in K8s or rebuild image.
The propose is to have an image without capabilities set on executable (tagged like v0.23-unprivileged).

Perhaps, I should have renamed the issue...

from blocky.

zc-devs commented on August 17, 2024

ghcr.io/0xerr0r/blocky:v0.24

While I confirm, that configuration below works in my cluster

apiVersion: apps/v1
kind: Deployment
metadata:
  name: blocky
spec:
...
      containers:
        - name: blocky
          image: ghcr.io/0xerr0r/blocky:v0.24
          ports:
            - name: dns-udp
              containerPort: 1053
              protocol: UDP
            - name: dns-tcp
              containerPort: 1053
              protocol: TCP
            - name: http
              containerPort: 4000
              protocol: TCP
          securityContext:
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
      securityContext:
        runAsUser: 100
        runAsGroup: 100
        runAsNonRoot: true
        fsGroup: 100
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault