containerd - allow root for somes images

[HujinoKun]

hello,

Is it possible to tell containerd with rke2 that it can run a container as root? I still have some images that use the root user

Version : v1.21.5+rke2r1

[brandond]

Containerd doesn't care what user you run images as. Are you perhaps deploying a pod with a securitycontext that doesn't allow running as root?

[brandond]

It sounds like you've deployed a PodSecurityPolicy to your cluster that doesn't allow root or privileged containers... see https://kubernetes.io/docs/concepts/policy/pod-security-policy/.

Are you running this on a hardened cluster, started with --profile=cis1.5, or has someone perhaps deployed some policies beyond those that ship with RKE2?

[brandond]

Also, see: https://docs.rke2.io/security/policies/

[HujinoKun]

I activated this profile : cis-1.6

[brandond]

Well yeah, that would do it. You've hardened your cluster, which prevents exactly what you're trying to do.

[HujinoKun]

Indeed, I went too hard on the restriction. Since it's for a lab, I'll restrict less.

Remediation: RKE2, when run with the --profile=cis-1.6 argument, will disallow the use of privileged containers.