{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22179","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22179/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22179/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22179/events","html_url":"https://github.com/kubernetes/kubernetes/issues/22179","id":137284707,"number":22179,"title":"Provide possibility to specify the group a container is run as","user":{"login":"vpal","id":3486417,"avatar_url":"https://avatars.githubusercontent.com/u/3486417?v=3","gravatar_id":"","url":"https://api.github.com/users/vpal","html_url":"https://github.com/vpal","followers_url":"https://api.github.com/users/vpal/followers","following_url":"https://api.github.com/users/vpal/following{/other_user}","gists_url":"https://api.github.com/users/vpal/gists{/gist_id}","starred_url":"https://api.github.com/users/vpal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vpal/subscriptions","organizations_url":"https://api.github.com/users/vpal/orgs","repos_url":"https://api.github.com/users/vpal/repos","events_url":"https://api.github.com/users/vpal/events{/privacy}","received_events_url":"https://api.github.com/users/vpal/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/documentation","name":"kind/documentation","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/support","name":"kind/support","color":"eb6420"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"milestone":null,"comments":10,"created_at":"2016-02-29T15:22:19Z","updated_at":"2016-03-11T09:39:24Z","closed_at":null,"body":"I have seen this mentioned regarding volumes in separate issues but I wanted to open a new issue that is not related to volumes to clarify how important this is despite that no volumes are mounted.\r\n\r\nPlease support the option to specify both the user and group the container is run as like docker does with the following option of the \"docker run\" command:\r\n`  -u, --user=                     Username or UID (format: <name|uid>[:<group|gid>])`\r\n\r\nThis would be important from a security perspective as there are a lot of images that run by default with root, but would be much safer to run with non root user and group.\r\nA good example for this is the etcd image from gcr.io: gcr.io/google_containers/etcd.\r\n\r\nAgain to emphasize the goal of this is not to provide access to shared filesystem resources, but to increase the level of security. \r\n\r\nWould be good to have additional supplementary groups too, but I don't see support for this in Docker. \r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/195290168","html_url":"https://github.com/kubernetes/kubernetes/issues/22179#issuecomment-195290168","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22179","id":195290168,"user":{"login":"vpal","id":3486417,"avatar_url":"https://avatars.githubusercontent.com/u/3486417?v=3","gravatar_id":"","url":"https://api.github.com/users/vpal","html_url":"https://github.com/vpal","followers_url":"https://api.github.com/users/vpal/followers","following_url":"https://api.github.com/users/vpal/following{/other_user}","gists_url":"https://api.github.com/users/vpal/gists{/gist_id}","starred_url":"https://api.github.com/users/vpal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vpal/subscriptions","organizations_url":"https://api.github.com/users/vpal/orgs","repos_url":"https://api.github.com/users/vpal/repos","events_url":"https://api.github.com/users/vpal/events{/privacy}","received_events_url":"https://api.github.com/users/vpal/received_events","type":"User","site_admin":false},"created_at":"2016-03-11T09:39:24Z","updated_at":"2016-03-11T09:39:24Z","body":"@pmorie thank you for dealing with this issue.\r\n\r\nYes, having the root filesystem read-only could reduce the attack vector caused by the fact that the process in the container is running with the group root.\r\n\r\nI think though that this is not enough and I believe that the only real solution form security and also operational point of view is to have fine grained control from Kubernetes over as what user the process in then container is running.\r\n\r\nSo your suggestion would of course help in a way, but my goal with opening this issue was really to make Kubernetes and services ran by it more secure and more usable and manageable and I think in achieving this it is essential to have fine grained control over process user, group and supplemental groups.\r\n\r\nI'm pretty confident that this functionality is important for people who try to carefully design their services and infrastructure.\r\n\r\nYou can also consider this issue as feature request."}}