<p>I am using docker service and kubernetes for container orchestration.</p>

<p>I would like to have all the volumes mounted from the host with the option nosuid.</p>

<p>Emptydir volumes could also live without suid. The only question is whether kubernetes supports specifying such mount options or if they can be handled somehow else.</p>

<pre><code> findmnt
  TARGET                  SOURCE      FSTYPE          OPTIONS
  /                       /dev/vda1   ext4            rw,noatime,seclabel,data=ordered
  ├─/sys                  sysfs       sysfs          rw,relatime,seclabel
  │ ├─/sys/kernel/security  securityfs  securityfs     rw,nosuid,nodev,noexec,relatime
  │ ├─/sys/fs/cgroup        tmpfs       tmpfs          ro,nosuid,nodev,noexec,seclabel,mode=755
  │ │ ├─/sys/fs/cgroup/systemd  cgroup      cgroup         rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/sy
  ...
  ├─/var/lib/kubelet/pods/05f79fe8-3fab-11e7-8c7b-d00d8969ec73/volumes/kubernetes.io~secret/default-token-lnpbh       tmpfs       tmpfs          rw,relatime,seclabel
  ├─/var/lib/kubelet/pods/0911e563-3fab-11e7-8c7b-d00d8969ec73/volumes/kubernetes.io~secret/default-token-lnpbh       tmpfs       tmpfs          rw,relatime,seclabel
  ├─/var/lib/kubelet/pods/b550adbd-3fbf-11e7-8c7b-d00d8969ec73/volumes/kubernetes.io~empty-dir/data                   tmpfs       tmpfs          rw,relatime,seclabel
</code></pre>

<p>Related issue from kubernetes: <a href="https://github.com/kubernetes/kubernetes/issues/48912" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/48912</a></p>

<p>As you mentioned, <code>EmptyDir</code> volumes can live without <code>suid</code> is correct but, as of now, there is no way to mention <code>nosuid</code> kind of mount options in Kubernetes Volume manifests.</p>
