Body: <p>I've created a daemonset which adds a systemd unit and timer file to every host in the cluster.</p>
  <pre><code>apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: logclean-updater
  spec:
    selector:
      matchLabels: 
        name: logclean-updater
      spec:
        containers:
        - name: logclean-updater
          image: alpine
          command: [&quot;/bin/sh&quot;, &quot;-c&quot;]
          args: [
                &quot;
                while true; do
                  echo '[Unit]\n
                  Description=Clean journal files\n
                  [Service]\n
                  ExecStart=/usr/bin/journalctl --vacuum-size=1M\n
                  SystemCallFilter=@default @file-system @basic-io @system-service\n
                  \n
                  [Install]\n
                  WantedBy=multi-user.target\n
                  ' &gt; /systemd/cleanjournal.service;
                  echo '[Unit]\n
  
                  [Timer]\n
                  OnCalendar=hourly\n
                  \n
                  [Install]\n
                  WantedBy=multi-user.target\n
                  ' &gt; /systemd/cleanjournal.timer;
                  sleep 60;\n
                done\n
                &quot;
                ]
          volumeMounts:
          - name: systemdpath
            mountPath: /systemd
        volumes:
        - name: systemdpath
          hostPath:
            path: /usr/lib/systemd/system
  </code></pre>
  <p>cleanjournal.timer and cleanjournal.service appear on the node as they should.</p>
  <p>But the first time the timer is not started, so now I need to manually call</p>
  <pre><code>systemctl start cleanjournal.timer
  </code></pre>
  <p>Is it possible do that from within the container? Or more general, can we call commands from a container on the host system?</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-10-14T13:12:10.747Z
Comments: So you're looking for a container escape vulnerability?
Comments: BMitch
Comments: CC BY-SA 4.0
Comments: 2021-10-14T13:20:00.967Z
Comments: looking for a timer which cleans log files on host on daily basis and when a new node joins the cluster it gets added there automatically too
Comments: Serve Laurijssen
Tags: <docker><kubernetes>
Title: calling shell commands on host from container
UserDisplayName: Serve Laurijssen
ThreadText: # calling shell commands on host from container
  
  (Asked by: username_0 on 2021-10-11)
  
  I've created a daemonset which adds a systemd unit and timer file to every host in the cluster.
  
  ```
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: logclean-updater
  spec:
    selector:
      matchLabels: 
        name: logclean-updater
      spec:
        containers:
        - name: logclean-updater
          image: alpine
          command: ["/bin/sh", "-c"]
          args: [
                "
                while true; do
                  echo '[Unit]\n
                  Description=Clean journal files\n
                  [Service]\n
                  ExecStart=/usr/bin/journalctl --vacuum-size=1M\n
                  SystemCallFilter=@default @file-system @basic-io @system-service\n
                  \n
                  [Install]\n
                  WantedBy=multi-user.target\n
                  ' > /systemd/cleanjournal.service;
                  echo '[Unit]\n
  
                  [Timer]\n
                  OnCalendar=hourly\n
                  \n
                  [Install]\n
                  WantedBy=multi-user.target\n
                  ' > /systemd/cleanjournal.timer;
                  sleep 60;\n
                done\n
                "
                ]
          volumeMounts:
          - name: systemdpath
            mountPath: /systemd
        volumes:
        - name: systemdpath
          hostPath:
            path: /usr/lib/systemd/system
  
  ```
  
  cleanjournal.timer and cleanjournal.service appear on the node as they should.
  
  But the first time the timer is not started, so now I need to manually call
  
  ```
  systemctl start cleanjournal.timer
  
  ```
  
  Is it possible do that from within the container? Or more general, can we call commands from a container on the host system?
  
  **Tags:** docker, kubernetes
  
  > **Comments:**
  > **username_1**: So you're looking for a container escape vulnerability?  
  > **username_0**: looking for a timer which cleans log files on host on daily basis and when a new node joins the cluster it gets added there automatically too  
  
  ---
  
  ## 0 answers
  
  