<p>What is the difference in privilege granted to a container in the following 2 scenarios</p>

<ol>
<li>sudo docker run -d --privileged --pid=host alpine:3.8 tail -f /dev/null</li>
<li>Using kubernetes</li>
</ol>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: nsenter-alpine
spec:
  hostPID: true
  containers:
    - name: nsenter-alpine
      image: alpine:3.8
      resources:
        limits:
          cpu: "500m"
          memory: "200Mi"
        requests:
          cpu: "100m"
          memory: "100Mi"
      command: ["tail"]
      args: ["-f", "/dev/null"]
      securityContext:
        privilege: true
</code></pre>

<p>in case 1)</p>

<pre><code>/ # ps -ef | wc -l
604
</code></pre>

<p>in case 2)</p>

<pre><code>[root@localhost /]# ps -ef | wc -l
266
</code></pre>

<p>Clearly when a privilege container is instantiated directly using docker then it is able to see processes of the host but when it is launched using kubernetes it can only see few of the processes. What is the reason behind it?</p>

himadri
<p><strong>Edit:</strong></p>

<p>I see you have <code>--pid=host</code> in <code>docker run</code> command and <code>hostPID: true</code> in kubernetes pod spec. In that case, both the numbers should be similar if the containers are running on same host. Check if the containers are running on same host or not. Kubernetes might have scheduled the pod to a different node. </p>

<hr>

<p><strong>Prev answer</strong></p>

<p><code>sudo docker run -d --privileged --pid=host alpine:3.8 tail -f /dev/null</code></p>

<p>In the above command, you are using <a href="https://docs.docker.com/engine/reference/run/#pid-settings---pid" rel="nofollow noreferrer"><code>--pid=host</code></a> argument which is running the container in host pid namespace. So you are able to view all the processes on the host. You can achieve the same with <code>hostPID</code> option in pod spec in kubernetes. </p>

<hr>

<p>Running a container in privileged mode means the processes in the container are essentially equal to root on the host. By default a container is not allowed to access any devices on the host, but a “privileged” container is given access to all devices on the host. </p>

<pre><code>$ kubectl exec -it no-privilege ls /dev
core             null             stderr           urandom
fd               ptmx             stdin            zero
full             pts              stdout
fuse             random           termination-log
mqueue           shm              tty
</code></pre>

<pre><code>$ kubectl exec -it privileged ls /dev
autofs              snd                 tty46
bsg                 sr0                 tty47
btrfs-control       stderr              tty48
core                stdin               tty49
cpu                 stdout              tty5
cpu_dma_latency     termination-log     tty50
fd                  tty                 tty51
full                tty0                tty52
fuse                tty1                tty53
hpet                tty10               tty54
hwrng               tty11               tty55
...
</code></pre>

<p><strong>The container still runs in it's own pid namespace, ipc namespace and network namespace</strong> etc. So you will not see host processes inside the container even when running in privileged mode. You can use <code>hostPID</code>, <code>hostNetwork</code>, <code>hostIPC</code> fields of <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#pod-v1-core" rel="nofollow noreferrer">pod spec</a> in Kubernetes if you want to run in the host namespace. </p>
