[Question] Running on kubernetes without privileged (v0.5.7)

[netfalo]

Hi,

The README states that since v0.5.7 the security context is not needed:

Since img v0.5.7, you don't need to specify any securityContext for running img as a Kubernetes container.

I assume this means it doesn't have to be privileged to run.

But when I create the following Pod:

apiVersion: v1
kind: Pod
metadata:
  name: img
spec:
  containers:
  - name: img
    image: <private_registry>/img:v0.5.7
    args: ['pull', '-d', 'alpine:latest']
    tty: true
  imagePullSecrets:
    - name: <secretname>

It exists with the following error message:

nsenter: cannot change root filesystem propagation: Permission denied

Am I missing something? Ofc if I add the privilieged=true to the securityContext it works, but I would rather not do that.

Versions

img: version : v0.5.7
git hash : d14bb92b
go version : go1.11.13
go compiler : gc
platform : linux/amd64

kubernetes v1.15.4-k3s.1 containerd v1.2.8-k3s.1

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label question to this issue, with a confidence of 0.95. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[AkihiroSuda]

You need annotations: container.apparmor.security.beta.kubernetes.io/img: unconfined container.seccomp.security.alpha.kubernetes.io/img: unconfined