<p>I've created a daemonset which adds a systemd unit and timer file to every host in the cluster.</p>
<pre><code>apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: logclean-updater
spec:
  selector:
    matchLabels: 
      name: logclean-updater
    spec:
      containers:
      - name: logclean-updater
        image: alpine
        command: [&quot;/bin/sh&quot;, &quot;-c&quot;]
        args: [
              &quot;
              while true; do
                echo '[Unit]\n
                Description=Clean journal files\n
                [Service]\n
                ExecStart=/usr/bin/journalctl --vacuum-size=1M\n
                SystemCallFilter=@default @file-system @basic-io @system-service\n
                \n
                [Install]\n
                WantedBy=multi-user.target\n
                ' &gt; /systemd/cleanjournal.service;
                echo '[Unit]\n

                [Timer]\n
                OnCalendar=hourly\n
                \n
                [Install]\n
                WantedBy=multi-user.target\n
                ' &gt; /systemd/cleanjournal.timer;
                sleep 60;\n
              done\n
              &quot;
              ]
        volumeMounts:
        - name: systemdpath
          mountPath: /systemd
      volumes:
      - name: systemdpath
        hostPath:
          path: /usr/lib/systemd/system
</code></pre>
<p>cleanjournal.timer and cleanjournal.service appear on the node as they should.</p>
<p>But the first time the timer is not started, so now I need to manually call</p>
<pre><code>systemctl start cleanjournal.timer
</code></pre>
<p>Is it possible do that from within the container? Or more general, can we call commands from a container on the host system?</p>

CC BY-SA 4.0
2021-10-14T13:12:10.747Z
So you're looking for a container escape vulnerability?
BMitch
CC BY-SA 4.0
2021-10-14T13:20:00.967Z
looking for a timer which cleans log files on host on daily basis and when a new node joins the cluster it gets added there automatically too
Serve Laurijssen
<docker><kubernetes>
calling shell commands on host from container
Serve Laurijssen
# calling shell commands on host from container

(Asked by: username_0 on 2021-10-11)

I've created a daemonset which adds a systemd unit and timer file to every host in the cluster.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: logclean-updater
spec:
  selector:
    matchLabels: 
      name: logclean-updater
    spec:
      containers:
      - name: logclean-updater
        image: alpine
        command: ["/bin/sh", "-c"]
        args: [
              "
              while true; do
                echo '[Unit]\n
                Description=Clean journal files\n
                [Service]\n
                ExecStart=/usr/bin/journalctl --vacuum-size=1M\n
                SystemCallFilter=@default @file-system @basic-io @system-service\n
                \n
                [Install]\n
                WantedBy=multi-user.target\n
                ' > /systemd/cleanjournal.service;
                echo '[Unit]\n

                [Timer]\n
                OnCalendar=hourly\n
                \n
                [Install]\n
                WantedBy=multi-user.target\n
                ' > /systemd/cleanjournal.timer;
                sleep 60;\n
              done\n
              "
              ]
        volumeMounts:
        - name: systemdpath
          mountPath: /systemd
      volumes:
      - name: systemdpath
        hostPath:
          path: /usr/lib/systemd/system

cleanjournal.timer and cleanjournal.service appear on the node as they should.
But the first time the timer is not started, so now I need to manually call
systemctl start cleanjournal.timer

Is it possible do that from within the container? Or more general, can we call commands from a container on the host system?

**Tags:** docker, kubernetes

> **Comments:**
> **username_1**: So you're looking for a container escape vulnerability?  
> **username_0**: looking for a timer which cleans log files on host on daily basis and when a new node joins the cluster it gets added there automatically too  

---

## 0 answers

