{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/community/issues/2067","repository_url":"https://api.github.com/repos/kubernetes/community","labels_url":"https://api.github.com/repos/kubernetes/community/issues/2067/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/community/issues/2067/comments","events_url":"https://api.github.com/repos/kubernetes/community/issues/2067/events","html_url":"https://github.com/kubernetes/community/pull/2067","id":317072802,"number":2067,"title":"Add proposal for node-level User Namespaces remapping support","user":{"login":"vikaschoudhary16","id":11936386,"avatar_url":"https://avatars3.githubusercontent.com/u/11936386?v=4","gravatar_id":"","url":"https://api.github.com/users/vikaschoudhary16","html_url":"https://github.com/vikaschoudhary16","followers_url":"https://api.github.com/users/vikaschoudhary16/followers","following_url":"https://api.github.com/users/vikaschoudhary16/following{/other_user}","gists_url":"https://api.github.com/users/vikaschoudhary16/gists{/gist_id}","starred_url":"https://api.github.com/users/vikaschoudhary16/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikaschoudhary16/subscriptions","organizations_url":"https://api.github.com/users/vikaschoudhary16/orgs","repos_url":"https://api.github.com/users/vikaschoudhary16/repos","events_url":"https://api.github.com/users/vikaschoudhary16/events{/privacy}","received_events_url":"https://api.github.com/users/vikaschoudhary16/received_events","type":"User","site_admin":false},"labels":[{"id":486032367,"url":"https://api.github.com/repos/kubernetes/community/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":653942785,"url":"https://api.github.com/repos/kubernetes/community/labels/kind/design","name":"kind/design","color":"c7def8","default":false},{"id":653942891,"url":"https://api.github.com/repos/kubernetes/community/labels/sig/node","name":"sig/node","color":"d2b48c","default":false},{"id":653942910,"url":"https://api.github.com/repos/kubernetes/community/labels/size/L","name":"size/L","color":"ee9900","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-04-24T05:15:06Z","updated_at":"2018-04-24T10:08:26Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/kubernetes/community/pulls/2067","html_url":"https://github.com/kubernetes/community/pull/2067","diff_url":"https://github.com/kubernetes/community/pull/2067.diff","patch_url":"https://github.com/kubernetes/community/pull/2067.patch"},"body":"\r\n/cc @mrunalp @adelton @derekwaynecarr @sjenning "},"comment":{"url":"https://api.github.com/repos/kubernetes/community/issues/comments/383877955","html_url":"https://github.com/kubernetes/community/pull/2067#issuecomment-383877955","issue_url":"https://api.github.com/repos/kubernetes/community/issues/2067","id":383877955,"user":{"login":"vikaschoudhary16","id":11936386,"avatar_url":"https://avatars3.githubusercontent.com/u/11936386?v=4","gravatar_id":"","url":"https://api.github.com/users/vikaschoudhary16","html_url":"https://github.com/vikaschoudhary16","followers_url":"https://api.github.com/users/vikaschoudhary16/followers","following_url":"https://api.github.com/users/vikaschoudhary16/following{/other_user}","gists_url":"https://api.github.com/users/vikaschoudhary16/gists{/gist_id}","starred_url":"https://api.github.com/users/vikaschoudhary16/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikaschoudhary16/subscriptions","organizations_url":"https://api.github.com/users/vikaschoudhary16/orgs","repos_url":"https://api.github.com/users/vikaschoudhary16/repos","events_url":"https://api.github.com/users/vikaschoudhary16/events{/privacy}","received_events_url":"https://api.github.com/users/vikaschoudhary16/received_events","type":"User","site_admin":false},"created_at":"2018-04-24T10:08:26Z","updated_at":"2018-04-24T10:08:26Z","author_association":"MEMBER","body":"> With the Beta phase of this proposal, users will be able to \"escape\" the user namespace using \"hostUserNamespace\": true in Pod Spec, controlled by PSP.\r\n>\r\n>However, users will also be able to escape the user namespace by simply having their Pod scheduled on a Node where docker is not configured with --userns-remap. If we do not specify the User NamespaceOption, we will get the Container Runtime default, which might either be no mapping (== host), or some non-host mapping.\r\n>\r\n> Are we thinking of a Node classification (does not support user namespaces (current docker without --userns-remap), supports one Node-level user namespace (current docker with --userns-remap, future CRI-O with --userns-uid-map and --userns-uid-map), supports per-Pod user namespace (future CRI-O)) which could close this loophole?\r\n\r\nNode classification based on runtime capabilities is an important point to discuss and is already being discussed [here to implement using a `RuntimeController`](https://docs.google.com/document/d/1EJKT4gyl58-kzt2bnwkv08MIUZ6lkDpXcxkHqCvvAp4/edit#heading=h.grgs3u22u7ze) . I would prefer to scope Node classification discussion out of this proposal. Thoughts?"}}
{"actor":{"display_login":"vikaschoudhary16"}}