{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30684","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30684/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30684/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30684/events","html_url":"https://github.com/kubernetes/kubernetes/pull/30684","id":171426265,"number":30684,"title":"Support host user namespace ","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-rebase","name":"needs-rebase","color":"BDBDBD"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-none","name":"release-note-none","color":"c2e0c6"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XXL","name":"size/XXL","color":"ee0000"}],"state":"open","locked":false,"assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"assignees":[{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false}],"milestone":null,"comments":21,"created_at":"2016-08-16T14:26:21Z","updated_at":"2016-08-16T21:16:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/30684","html_url":"https://github.com/kubernetes/kubernetes/pull/30684","diff_url":"https://github.com/kubernetes/kubernetes/pull/30684.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/30684.patch"},"body":"@smarterclayton @ncdc @mrunalp This adds the host user flag to the PSC and threads through the parameter for all containers of the pod (including the pause container).  This does not include any PSP changes.\r\n\r\nAlso, to see the UsernsMode in inspect output you need a compatible docker version however after testing on 1.10.3 and 1.12 there didn't seem to be any adverse affects to having the parameter set in the api on the lower version. \r\n\r\n```\r\n[pweil@localhost userns]$ docker ps\r\nCONTAINER ID        IMAGE                                      COMMAND                  CREATED             STATUS              PORTS               NAMES\r\n9c4a8f0a2b7b        nginx                                      \"nginx -g 'daemon off\"   57 seconds ago      Up 55 seconds                           k8s_nginx.b2db2f1d_userns_default_075cf376-63bc-11e6-9447-54ee752009cb_263fdfb4\r\n9dd4c7ee1d34        gcr.io/google_containers/pause-amd64:3.0   \"/pause\"                 58 seconds ago      Up 57 seconds                           k8s_POD.b2390301_userns_default_075cf376-63bc-11e6-9447-54ee752009cb_de217910\r\n[pweil@localhost userns]$ docker inspect 9dd4 | grep UsernsMode\r\n            \"UsernsMode\": \"host\",\r\n[pweil@localhost userns]$ docker inspect 9c4 | grep UsernsMode\r\n            \"UsernsMode\": \"host\",\r\n[pweil@localhost userns]$ cat pod.yaml\r\n# Copy of pod.yaml without file extension for test\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: userns\r\n  labels:\r\n    name: userns\r\nspec:\r\n  securityContext:\r\n      hostUser: true\r\n  containers:\r\n  - name: nginx\r\n    image: nginx\r\n    ports:\r\n    - containerPort: 80\r\n```\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes/30684)\n<!-- Reviewable:end -->\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/240241760","html_url":"https://github.com/kubernetes/kubernetes/pull/30684#issuecomment-240241760","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30684","id":240241760,"user":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"created_at":"2016-08-16T21:16:38Z","updated_at":"2016-08-16T21:16:38Z","body":"On Tue, Aug 16, 2016 at 2:11 PM, Mrunal Patel <notifications@github.com> wrote:\n>\n> I just checked latest docker to be certain. It is in fact blocking --net=host, --pid=host and --ipc=host when user namespaces are enabled. It should be allowed when --userns=host. I'll create a PR for that.\n\nSorry, I have trouble parsing this.What is \"it\" here?\n\n> But yeah, setting --userns=host when other namespaces are using the host namespaces should be a good default unless you have edge cases like wanting to bind to higher port on the host while still using user namespaces in the container.\n\nCan we write out a full table of the intersection of these features,\nwhat features should imply other features, and what features should\nblock other features?\n"}}
{"actor":{"display_login":"thockin"}}