<p>I am trying to remove privileged mode from init container, when i set to priviliged: false. I am getting above error. I had set readOnlyRootFilesystem: false and lines below at the pod securityContext level</p>
<pre><code>  securityContext:
    sysctls:
    - name: net.ipv4.ip_local_port_range
      value: 0 65535
</code></pre>

sacboy
<p>The problem is that you cannot run <code>sysctl</code> without the privileged mode due to security reasons. This is expected since docker restricts access to <code>/proc</code> and <code>/sys</code>.</p>
<p>In order for this to work you need to use the privileged mode for the init container and than either:</p>
<ul>
<li><a href="https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/" rel="nofollow noreferrer">Use sysctls in a Kubernetes Cluster</a> by specifing a proper <code>securityContext</code> for a Pod. For example:</li>
</ul>
<hr />
<pre><code>  securityContext:
    sysctls:
    - name: kernel.shm_rmid_forced
      value: &quot;0&quot;
    - name: net.core.somaxconn
      value: &quot;1024&quot;
    - name: kernel.msgmax
      value: &quot;65536&quot;
</code></pre>
<ul>
<li>Use <a href="https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime" rel="nofollow noreferrer">PodSecurityPolicy</a> to control which <code>sysctls</code> can be set in pods by specifying lists of <code>sysctls</code> or <code>sysctl</code> patterns in the <code>forbiddenSysctls</code> and/or <code>allowedUnsafeSysctls</code> fields of the <code>PodSecurityPolicy</code>. For example:</li>
</ul>
<hr />
<pre><code>apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: sysctl-psp
spec:
  allowedUnsafeSysctls:
  - kernel.msg*
  forbiddenSysctls:
  - kernel.shm_rmid_forced
</code></pre>
<p>Notice that:</p>
<blockquote>
<p>If you allow unsafe <code>sysctls</code> via the <code>allowedUnsafeSysctls</code> field in a
<code>PodSecurityPolicy</code>, any pod using such a <code>sysctl</code> will fail to start if
the <code>sysctl</code> is not allowed via the <code>--allowed-unsafe-sysctls</code> kubelet
flag as well on that node.</p>
</blockquote>
<ul>
<li>You can also set a limited number of <code>sysctls</code> on a container-local basis with <a href="https://docs.docker.com/engine/reference/commandline/run/#configure-namespaced-kernel-parameters-sysctls-at-runtime" rel="nofollow noreferrer"><code>docker run --sysctl</code></a>.</li>
</ul>
<p>I also recommend going through the whole linked documentation as caution is advised because use of unsafe <code>sysctls</code> is at-your-own-risk and can lead to severe problems like wrong behavior of containers, resource shortage or complete breakage of a node.</p>
