<p>As a Kubernetes cluster admin, I was asked to enable the <strong>chown</strong>, <strong>dac_override</strong> and <strong>fowner</strong> Linux capabilities in the SHARED Kubernetes cluster for some special Pods.</p>

<p>But I found it is horrible to open these capabilities in Container:
<a href="https://www.redhat.com/en/blog/secure-your-containers-one-weird-trick" rel="nofollow noreferrer">https://www.redhat.com/en/blog/secure-your-containers-one-weird-trick</a> </p>

<p>I would like to know if the Pods can ONLY use these capabilities on the files/folders in the Pod? Or they can also use them on the host files/folders to hack something?</p>

<p>I also open the RunAsRoot permission but disable the Privileged permission.</p>

<p>So I would like to know if there is any security issue to enable these capabilities in Kube cluster?</p>

<p>Or is there any way to JUST allow some special Pods to have these capabilities?</p>

<p>Thanks a lot!</p>

user13220731
<p>As long as you trust k8s controllers (Deployment, StatefulSet, DaemonSet) of these pods - you're fine with additional filesystem-related capabilities. By default, pods cannot write to host filesystem. And You shouldn't have <code>hostPath</code> <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="nofollow noreferrer">volumes</a> in controllers of your special pods to eliminate host filesystem write from inside these pods.</p>
