Skip to content

Refine individual capabilities assigned on each helm shard configuration

Problem

At the moment all the CI containers are run in privileged mode, due to the configuration:

    securityContext:
      privileged: {{ .Values.isPriviliged }}

Where .isPriviliged: true.

This is too permissive.

Proposal

We should adhere to the principle of least privilege when setting up our containers. For example with:

    securityContext:
      capabilities:
        add: ["SYS_PTRACE"]

Having this in mind, we should explicitly list the individual capabilities that are needed by each component, and configure them. For example

  • gdb: CAP_SYS_PTRACE
  • cta-taped: CAP_SYS_RAWIO