<p>I would like to set <code>net.ipv4.tcp_timestamps=0</code> in Pods of my k8s cluster, However it gives me error:</p>

<blockquote>
  <p>sysctl: cannot stat /proc/sys/net/ipv4/tcp_timestamps: No such file or directory" </p>
</blockquote>

<p>Same issue with container directly created with <code>docker run</code> command. Anyway to set the parameter in container/Pod? Thanks.</p>

James Pei
<p>In Kubernetes <code>sysctl</code> have been grouped into <code>safe</code> and <code>unsafe</code>. </p>

<blockquote>
  <p>In addition to proper namespacing, a  <em>safe</em>  sysctl must be properly  <em>isolated</em>  between pods on the same node. This means that setting a  <em>safe</em>  sysctl for one pod</p>
  
  <ul>
  <li>must not have any influence on any other pod on the node</li>
  <li>must not allow to harm the node’s health</li>
  <li>must not allow to gain CPU or memory resources outside of the resource limits of a pod.</li>
  </ul>
  
  <p>By far, most of the  <em>namespaced</em>  sysctls are not necessarily considered  <em>safe</em>. The following sysctls are supported in the  <em>safe</em>  set:</p>
  
  <ul>
  <li><code>kernel.shm_rmid_forced</code>,</li>
  <li><code>net.ipv4.ip_local_port_range</code>,</li>
  <li><code>net.ipv4.tcp_syncookies</code>.</li>
  </ul>
</blockquote>

<p>By default all <code>safe sysctls</code> are enabled by default.
All <code>unsafe sysctls</code>  are disabled and need to be allowed manually by cluster admin on each node.</p>

<blockquote>
  <pre class="lang-sh prettyprint-override"><code>kubelet --allowed-unsafe-sysctls \
 'kernel.msg*,net.core.somaxconn' ...
</code></pre>
  
  <p>For  <a href="https://kubernetes.io/docs/setup/learning-environment/minikube/" rel="nofollow noreferrer">Minikube</a>, this can be done via the  <code>extra-config</code>  flag:</p>
  
  <pre class="lang-sh prettyprint-override"><code>minikube start --extra-config="kubelet.allowed-unsafe-sysctls=kernel.msg*,net.core.somaxconn"...
</code></pre>
  
  <p>Only  <em>namespaced</em>  sysctls can be enabled this way.</p>
</blockquote>

<p>This is mentioned on <a href="https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls" rel="nofollow noreferrer">Enabling Unsafe Sysctls</a> k8s documentation.</p>

<p>As for, <a href="https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#setting-sysctls-for-a-pod" rel="nofollow noreferrer">Setting Sysctls for a Pod</a>:</p>

<blockquote>
  <p>A number of sysctls are  <em>namespaced</em>  in today’s Linux kernels. This means that they can be set independently for each pod on a node. Only namespaced sysctls are configurable via the pod securityContext within Kubernetes.</p>
  
  <p>The following sysctls are known to be namespaced. This list could change in future versions of the Linux kernel.
  -   <code>kernel.shm*</code>,
  -   <code>kernel.msg*</code>,
  -   <code>kernel.sem</code>,
  -   <code>fs.mqueue.*</code>,
  -   The parameters under  <code>net.*</code>  that can be set in container networking namespace. However, there are exceptions (e.g.,  <code>net.netfilter.nf_conntrack_max</code>  and  <code>net.netfilter.nf_conntrack_expect_max</code>  can be set in container networking namespace but they are unnamespaced).</p>
  
  <p>Sysctls with no namespace are called  <em>node-level</em>  sysctls. If you need to set them, you must manually configure them on each node’s operating system, or by using a DaemonSet with privileged containers.</p>
  
  <p>Use the pod securityContext to configure namespaced sysctls. The securityContext applies to all containers in the same pod.</p>
  
  <p>This example uses the pod securityContext to set a safe sysctl  <code>kernel.shm_rmid_forced</code>  and two unsafe sysctls  <code>net.core.somaxconn</code>  and  <code>kernel.msgmax</code>. There is no distinction between  <em>safe</em>  and  <em>unsafe</em>  sysctls in the specification.</p>
</blockquote>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
spec:
  securityContext:
    sysctls:
    - name: kernel.shm_rmid_forced
      value: "0"
    - name: net.core.somaxconn
      value: "1024"
    - name: kernel.msgmax
      value: "65536"
  ...
</code></pre>

<p>You may be interested in reading following questions on StackOverflow <a href="https://security.stackexchange.com/questions/111794/pros-and-cons-of-disabling-tcp-timestamps">Pros and cons of disabling TCP timestamps</a> and <a href="https://stackoverflow.com/questions/7880383/what-benefit-is-conferred-by-tcp-timestamp">What benefit is conferred by TCP timestamp?</a>.</p>
