<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/</a></p>

<p><a href="https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/" rel="nofollow noreferrer">https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/</a></p>

<blockquote>
  <p>With Linux capabilities, you can grant certain privileges to a process
  without granting all the privileges of the root user. To add or remove
  Linux capabilities for a Container, include the capabilities field in
  the securityContext section of the Container manifest.</p>
</blockquote>

<p>In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.</p>

<p>There is an open issue:</p>

<p><a href="https://github.com/kubernetes/kubernetes/issues/7961" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/7961</a></p>

CC BY-SA 3.0
2017-09-21T09:28:46.197Z
this is not exactly answer to my question - kernel capabilities management is available for Docker as well.
Ta Mu
CC BY-SA 3.0
2017-09-21T08:45:20.407Z
2017-09-21T10:28:57.887Z
2017-09-21T10:28:57.887Z
030
<p>Docker daemon has to run in root mode which brings up security discussions. </p>

<p>How is this with Kubernetes daemon - can it run not as root? </p>

<p>Note: both of these products allow you to reduce the scope of kernel capabilities allowed for containers but this is not the question. </p>

CC BY-SA 3.0
2017-09-21T10:12:06.657Z
How does the the production k8s cluster look like? On what platform does it run? How has it been created?
030
CC BY-SA 3.0
2017-09-21T11:19:22.377Z
I want to design and build a prototypic prod one and play with it :)
Ta Mu
CC BY-SA 3.0
2017-09-21T13:44:35.017Z
K8S is just sitting on top of docker, so there's still a docker daemon running (as root). If you're talking about kubelet it has to run as root as well, at least so it can open the low ports (80, 443) on the node if you end up defining a service with a node port.
Tensibai
CC BY-SA 3.0
2017-09-21T13:56:39.813Z
Hmm I thought k8s has been there before Docker?
Ta Mu
CC BY-SA 3.0
2017-11-20T13:13:41.353Z
As community user brings this up I may answer previous comment: I didn't dig into k8s and docker history, but that's irrelevant to answer the question, k8s just control docker (if you prefer that wording) and as such I still have no idea what you're talking about with 'kubernetes daemon', are you asking about the container manager or kubelet service ?
Tensibai
CC BY-SA 3.0
2017-11-20T13:16:51.330Z
thx - I am also not so sure yet what I am talking about :-) but answer by @030 seems to shed light onto the fact things with granting privilegies do not work yet as they should.
Ta Mu
<docker><kubernetes><security>
Kubernetes user mode in production
Ta Mu
# Kubernetes user mode in production

(Asked by: username_0 on 2017-09-21)

Docker daemon has to run in root mode which brings up security discussions.

How is this with Kubernetes daemon - can it run not as root?

Note: both of these products allow you to reduce the scope of kernel capabilities allowed for containers but this is not the question.

**Tags:** docker, kubernetes, security

> **Comments:**
> **username_1**: How does the the production k8s cluster look like? On what platform does it run? How has it been created?  
> **username_0**: I want to design and build a prototypic prod one and play with it :)  
> **username_2**: K8S is just sitting on top of docker, so there's still a docker daemon running (as root). If you're talking about kubelet it has to run as root as well, at least so it can open the low ports (80, 443) on the node if you end up defining a service with a node port.  
> **username_0**: Hmm I thought k8s has been there before Docker?  
> **username_2**: As community user brings this up I may answer previous comment: I didn't dig into k8s and docker history, but that's irrelevant to answer the question, k8s just control docker (if you prefer that wording) and as such I still have no idea what you're talking about with 'kubernetes daemon', are you asking about the container manager or kubelet service ?  
> **username_0**: thx - I am also not so sure yet what I am talking about :-) but answer by @username_1 seems to shed light onto the fact things with granting privilegies do not work yet as they should.  

---

## 1 answers

### Answer by username_1 on 2017-09-21. Score: 1

<https://kubernetes.io/docs/tasks/configure-pod-container/security-context/>

<https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/>

> With Linux capabilities, you can grant certain privileges to a process
> without granting all the privileges of the root user. To add or remove
> Linux capabilities for a Container, include the capabilities field in
> the securityContext section of the Container manifest.

In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.

There is an open issue:

<https://github.com/kubernetes/kubernetes/issues/7961>

> **Comments:**
> **username_0**: this is not exactly answer to my question - kernel capabilities management is available for Docker as well.  

---

