{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057/events","html_url":"https://github.com/kubernetes/kubernetes/pull/26057","id":156238887,"number":26057,"title":"Add sysctl proposal","user":{"login":"sttts","id":730123,"avatar_url":"https://avatars.githubusercontent.com/u/730123?v=3","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/api","name":"area/api","color":"e1ed21"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20human-approved","name":"cla: human-approved","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/design","name":"kind/design","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-none","name":"release-note-none","color":"c2e0c6"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/retest-not-required","name":"retest-not-required","color":"eb6420"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900"}],"state":"open","locked":false,"assignee":{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},"assignees":[{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},{"login":"dchen1107","id":7740897,"avatar_url":"https://avatars.githubusercontent.com/u/7740897?v=3","gravatar_id":"","url":"https://api.github.com/users/dchen1107","html_url":"https://github.com/dchen1107","followers_url":"https://api.github.com/users/dchen1107/followers","following_url":"https://api.github.com/users/dchen1107/following{/other_user}","gists_url":"https://api.github.com/users/dchen1107/gists{/gist_id}","starred_url":"https://api.github.com/users/dchen1107/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dchen1107/subscriptions","organizations_url":"https://api.github.com/users/dchen1107/orgs","repos_url":"https://api.github.com/users/dchen1107/repos","events_url":"https://api.github.com/users/dchen1107/events{/privacy}","received_events_url":"https://api.github.com/users/dchen1107/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/17","html_url":"https://github.com/kubernetes/kubernetes/milestones/next-candidate","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/17/labels","id":1510379,"number":17,"title":"next-candidate","description":"Candidates for the next milestone","creator":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"open_issues":308,"closed_issues":82,"state":"open","created_at":"2016-01-16T17:58:20Z","updated_at":"2016-06-30T06:11:16Z","due_on":null,"closed_at":null},"comments":16,"created_at":"2016-05-23T09:38:03Z","updated_at":"2016-06-30T09:49:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/26057","html_url":"https://github.com/kubernetes/kubernetes/pull/26057","diff_url":"https://github.com/kubernetes/kubernetes/pull/26057.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/26057.patch"},"body":"Solves https://github.com/kubernetes/kubernetes/issues/5095.\r\nAuthors: @hodovska, @ingvagabund, @sttts\r\n\r\nTODO / Open Questions:\r\n- [x] investigate pod vs. containers sysctl namespaces (IPC+net are shared among containers of a pod)\r\n- [x] investigate error behaviour if disallowed sysctls are passed to Docker\r\n- [x] get rkt feedback /cc @s-urbaniak\r\n- [x] investigate implications of `PodSecurityContext`. Is there any policy part involved to control who can change the security context and how?\r\n- [x] check whether this proposal is in-line with the plan for `PodSecurityContext`: compare [proposal](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/security-context-constraints.md) and [open issues of the implementation](https://github.com/kubernetes/kubernetes/issues/23217) /cc @pweil- "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/229613744","html_url":"https://github.com/kubernetes/kubernetes/pull/26057#issuecomment-229613744","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/26057","id":229613744,"user":{"login":"sttts","id":730123,"avatar_url":"https://avatars.githubusercontent.com/u/730123?v=3","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"created_at":"2016-06-30T09:49:59Z","updated_at":"2016-06-30T09:49:59Z","body":"@erictune The reason we don't have that in the proposal is that we might support runtimes (e.g. hyper?) in the future that don't depend on Linux namespaces. In those contexts the whitelist might be too strict.\r\n\r\nI am also fine with (re-)adding a whitelist for now. If necessary some day, we can still get rid of the whitelist and be more permissive without breaking backwards compatibility."}}
{"actor":{"display_login":"sttts"}}