Answers: <p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/</a></p>
  
  <p><a href="https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/" rel="nofollow noreferrer">https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/</a></p>
  
  <blockquote>
    <p>With Linux capabilities, you can grant certain privileges to a process
    without granting all the privileges of the root user. To add or remove
    Linux capabilities for a Container, include the capabilities field in
    the securityContext section of the Container manifest.</p>
  </blockquote>
  
  <p>In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.</p>
  
  <p>There is an open issue:</p>
  
  <p><a href="https://github.com/kubernetes/kubernetes/issues/7961" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/7961</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-21T09:28:46.197Z
Answers: this is not exactly answer to my question - kernel capabilities management is available for Docker as well.
Answers: Ta Mu
Answers: CC BY-SA 3.0
Answers: 2017-09-21T08:45:20.407Z
Answers: 2017-09-21T10:28:57.887Z
Answers: 2017-09-21T10:28:57.887Z
Answers: 030
Body: <p>Docker daemon has to run in root mode which brings up security discussions. </p>
  
  <p>How is this with Kubernetes daemon - can it run not as root? </p>
  
  <p>Note: both of these products allow you to reduce the scope of kernel capabilities allowed for containers but this is not the question. </p>
  
Comments: CC BY-SA 3.0
Comments: 2017-09-21T10:12:06.657Z
Comments: How does the the production k8s cluster look like? On what platform does it run? How has it been created?
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-09-21T11:19:22.377Z
Comments: I want to design and build a prototypic prod one and play with it :)
Comments: Ta Mu
Comments: CC BY-SA 3.0
Comments: 2017-09-21T13:44:35.017Z
Comments: K8S is just sitting on top of docker, so there's still a docker daemon running (as root). If you're talking about kubelet it has to run as root as well, at least so it can open the low ports (80, 443) on the node if you end up defining a service with a node port.
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-09-21T13:56:39.813Z
Comments: Hmm I thought k8s has been there before Docker?
Comments: Ta Mu
Comments: CC BY-SA 3.0
Comments: 2017-11-20T13:13:41.353Z
Comments: As community user brings this up I may answer previous comment: I didn't dig into k8s and docker history, but that's irrelevant to answer the question, k8s just control docker (if you prefer that wording) and as such I still have no idea what you're talking about with 'kubernetes daemon', are you asking about the container manager or kubelet service ?
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-11-20T13:16:51.330Z
Comments: thx - I am also not so sure yet what I am talking about :-) but answer by @030 seems to shed light onto the fact things with granting privilegies do not work yet as they should.
Comments: Ta Mu
Tags: <docker><kubernetes><security>
Title: Kubernetes user mode in production
UserDisplayName: Ta Mu
ThreadText: # Kubernetes user mode in production
  
  (Asked by: username_0 on 2017-09-21)
  
  Docker daemon has to run in root mode which brings up security discussions.
  
  How is this with Kubernetes daemon - can it run not as root?
  
  Note: both of these products allow you to reduce the scope of kernel capabilities allowed for containers but this is not the question.
  
  **Tags:** docker, kubernetes, security
  
  > **Comments:**
  > **username_1**: How does the the production k8s cluster look like? On what platform does it run? How has it been created?  
  > **username_0**: I want to design and build a prototypic prod one and play with it :)  
  > **username_2**: K8S is just sitting on top of docker, so there's still a docker daemon running (as root). If you're talking about kubelet it has to run as root as well, at least so it can open the low ports (80, 443) on the node if you end up defining a service with a node port.  
  > **username_0**: Hmm I thought k8s has been there before Docker?  
  > **username_2**: As community user brings this up I may answer previous comment: I didn't dig into k8s and docker history, but that's irrelevant to answer the question, k8s just control docker (if you prefer that wording) and as such I still have no idea what you're talking about with 'kubernetes daemon', are you asking about the container manager or kubelet service ?  
  > **username_0**: thx - I am also not so sure yet what I am talking about :-) but answer by @username_1 seems to shed light onto the fact things with granting privilegies do not work yet as they should.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-09-21. Score: 1
  
  <https://kubernetes.io/docs/tasks/configure-pod-container/security-context/>
  
  <https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/>
  
  > With Linux capabilities, you can grant certain privileges to a process
  > without granting all the privileges of the root user. To add or remove
  > Linux capabilities for a Container, include the capabilities field in
  > the securityContext section of the Container manifest.
  
  In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.
  
  There is an open issue:
  
  <https://github.com/kubernetes/kubernetes/issues/7961>
  
  > **Comments:**
  > **username_0**: this is not exactly answer to my question - kernel capabilities management is available for Docker as well.  
  
  ---
  
  