{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/features/issues/135","repository_url":"https://api.github.com/repos/kubernetes/features","labels_url":"https://api.github.com/repos/kubernetes/features/issues/135/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/features/issues/135/comments","events_url":"https://api.github.com/repos/kubernetes/features/issues/135/events","html_url":"https://github.com/kubernetes/features/issues/135","id":185127996,"node_id":"MDU6SXNzdWUxODUxMjc5OTY=","number":135,"title":"Seccomp","user":{"login":"pweil-","id":5230419,"node_id":"MDQ6VXNlcjUyMzA0MTk=","avatar_url":"https://avatars2.githubusercontent.com/u/5230419?v=4","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"labels":[{"id":627979438,"node_id":"MDU6TGFiZWw2Mjc5Nzk0Mzg=","url":"https://api.github.com/repos/kubernetes/features/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false},{"id":413888074,"node_id":"MDU6TGFiZWw0MTM4ODgwNzQ=","url":"https://api.github.com/repos/kubernetes/features/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":413888892,"node_id":"MDU6TGFiZWw0MTM4ODg4OTI=","url":"https://api.github.com/repos/kubernetes/features/labels/sig/node","name":"sig/node","color":"d2b48c","default":false},{"id":500133809,"node_id":"MDU6TGFiZWw1MDAxMzM4MDk=","url":"https://api.github.com/repos/kubernetes/features/labels/stage/alpha","name":"stage/alpha","color":"d93f0b","default":false},{"id":820252779,"node_id":"MDU6TGFiZWw4MjAyNTI3Nzk=","url":"https://api.github.com/repos/kubernetes/features/labels/tracked/no","name":"tracked/no","color":"e04338","default":false}],"state":"open","locked":false,"assignee":{"login":"pweil-","id":5230419,"node_id":"MDQ6VXNlcjUyMzA0MTk=","avatar_url":"https://avatars2.githubusercontent.com/u/5230419?v=4","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"assignees":[{"login":"pweil-","id":5230419,"node_id":"MDQ6VXNlcjUyMzA0MTk=","avatar_url":"https://avatars2.githubusercontent.com/u/5230419?v=4","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},{"login":"tallclair","id":29742491,"node_id":"MDQ6VXNlcjI5NzQyNDkx","avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false}],"milestone":null,"comments":36,"created_at":"2016-10-25T14:06:37Z","updated_at":"2018-09-11T18:59:54Z","closed_at":null,"author_association":"MEMBER","body":"# Description\r\n\r\nSeccomp support is providing the ability to define seccomp profiles and configure pods to run with those profiles.  This includes the ability control usage of the profiles via PSP as well as maintaining the ability to run as unconfined or with the default container runtime profile.\r\n# Progress Tracker\r\n- [x] Alpha\r\n  - [ ] Write and maintain draft quality doc: available in downstream OpenShift https://github.com/openshift/openshift-docs/pull/2975\r\n  - [ ] Design Approval\r\n    - [x] Design Proposal #24602\r\n    - [x] Decide which repo this feature's code will be checked into. Not everything needs to land in the core kubernetes repo. **REPO-NAME**\r\n    - [x] Initial API review (if API).  Maybe same PR as design doc. https://github.com/kubernetes/kubernetes/pull/24602\r\n      -  Any code that changes an API (`/pkg/apis/...`)\r\n      -  **cc `@kubernetes/api`**\r\n    - [ ] Identify shepherd (your SIG lead and/or kubernetes-pm@googlegroups.com will be able to help you). **My Shepherd is:** _replace.me@replaceme.com_ (and/or GH Handle)\r\n      -  A shepherd is an individual who will help acquaint you with the process of getting your feature into the repo, identify reviewers and provide feedback on the feature. They are _not_ (necessarily) the code reviewer of the feature, or tech lead for the area.\r\n      -  The shepherd is _not_ responsible for showing up to Kubernetes-PM meetings and/or communicating if the feature is on-track to make the release goals. That is still your responsibility.\r\n    - [ ] Identify secondary/backup contact point. **My Secondary Contact Point is:** _replace.me@replaceme.com_ (and/or GH Handle)\r\n  - [ ] Write (code + tests + docs) then get them merged.  https://github.com/kubernetes/kubernetes/pull/25324 https://github.com/kubernetes/kubernetes/pull/26710 https://github.com/kubernetes/kubernetes/pull/27036\r\n    - [ ] ~~**Code needs to be disabled by default.**   Verified by code OWNERS~~\r\n    - [x] Minimal testing: limited e2e tests https://github.com/kubernetes/kubernetes/blob/33ebe1f18b9cf5909931376f656e19e80ac9ac1c/test/e2e/security_context.go#L110\r\n    - [ ] Minimal docs\r\n      - cc `@kubernetes/docs` on docs PR\r\n      - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n      - New apis: _Glossary Section Item_ in the docs repo: kubernetes/kubernetes.github.io\r\n    - [x] Update release notes https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md/#changes-since-v130-alpha4\r\n- [ ] Beta\r\n  - [ ] Testing is sufficient for beta\r\n  - [ ] User docs with tutorials\r\n    - _Updated walkthrough / tutorial_ in the docs repo: kubernetes/kubernetes.github.io\r\n    - cc `@kubernetes/docs` on docs PR\r\n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n  - [ ] Thorough API review\r\n    - **cc `@kubernetes/api`**\r\n- [ ] Stable\r\n  - [ ] docs/proposals/foo.md moved to docs/design/foo.md \r\n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n  - [ ] Soak, load testing  \r\n  - [ ] detailed user docs and examples\r\n    - **cc `@kubernetes/docs`**\r\n    - **cc `@kubernetes/feature-reviewers` on this issue** to get approval before checking this off\r\n\r\n_FEATURE_STATUS is used for feature tracking and to be updated by `@kubernetes/feature-reviewers`._\r\n**FEATURE_STATUS: IN_DEVELOPMENT**\r\n\r\nMore advice:\r\n\r\nDesign\r\n- Once you get LGTM from a _`@kubernetes/feature-reviewers`_ member, you can check this checkbox, and the reviewer will apply the \"design-complete\" label.\r\n\r\nCoding\r\n- Use as many PRs as you need.  Write tests in the same or different PRs, as is convenient for you.\r\n- As each PR is merged, add a comment to this issue referencing the PRs.  Code goes in the http://github.com/kubernetes/kubernetes repository,\r\n      and sometimes http://github.com/kubernetes/contrib, or other repos.\r\n- When you are done with the code, apply the \"code-complete\" label.\r\n- When the feature has user docs, please add a comment mentioning `@kubernetes/feature-reviewers` and they will\r\n      check that the code matches the proposed feature and design, and that everything is done, and that there is adequate\r\n      testing.  They won't do detailed code review: that already happened when your PRs were reviewed.\r\n      When that is done, you can check this box and the reviewer will apply the \"code-complete\" label.\r\n\r\nDocs\r\n- [ ] Write user docs and get them merged in.\r\n- User docs go into http://github.com/kubernetes/kubernetes.github.io.\r\n- When the feature has user docs, please add a comment mentioning `@kubernetes/docs`.\r\n- When you get LGTM, you can check this checkbox, and the reviewer will apply the \"docs-complete\" label.\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/features/issues/comments/420384501","html_url":"https://github.com/kubernetes/features/issues/135#issuecomment-420384501","issue_url":"https://api.github.com/repos/kubernetes/features/issues/135","id":420384501,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDM4NDUwMQ==","user":{"login":"wangzhen127","id":1891250,"node_id":"MDQ6VXNlcjE4OTEyNTA=","avatar_url":"https://avatars0.githubusercontent.com/u/1891250?v=4","gravatar_id":"","url":"https://api.github.com/users/wangzhen127","html_url":"https://github.com/wangzhen127","followers_url":"https://api.github.com/users/wangzhen127/followers","following_url":"https://api.github.com/users/wangzhen127/following{/other_user}","gists_url":"https://api.github.com/users/wangzhen127/gists{/gist_id}","starred_url":"https://api.github.com/users/wangzhen127/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wangzhen127/subscriptions","organizations_url":"https://api.github.com/users/wangzhen127/orgs","repos_url":"https://api.github.com/users/wangzhen127/repos","events_url":"https://api.github.com/users/wangzhen127/events{/privacy}","received_events_url":"https://api.github.com/users/wangzhen127/received_events","type":"User","site_admin":false},"created_at":"2018-09-11T18:59:54Z","updated_at":"2018-09-11T18:59:54Z","author_association":"NONE","body":"> It would seem that the comment #135 (comment) still holds and summarizes exactly the work that needs to be done now.\r\n\r\nThat is right. One more thing I would like to add is to have a \"complaint\" mode. So users have a choice of getting warnings (in logs) of using forbidden syscalls rather than kill. Logging seccomp actions are available with Linux kernel 4.14+ ([seccomp doc](http://man7.org/linux/man-pages/man2/seccomp.2.html)). It is possible that older kernel versions are still being used. So we need to handle that. This will also need to be added to OCI spec.\r\n\r\n> I also noticed you were trying to add a FeatureGate for this, but closed the PR, why was that?\r\n\r\nThe purpose of that feature gate was to change seccomp default profile from unconfined to \"runtime/default\". I got many concerns on backward compatibility, so that seemed unlikely to happen. We are currently lack of a plan of changing security defaults in general because those are breaking. The best approach I currently think is to push seccomp to stable and it still has to be an opt-in feature rather than opt-out."}}
{"actor":{"display_login":"wangzhen127"}}