{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/2630","id":50202938,"number":2630,"title":"Volumes are created in container with root ownership and strict permissions","user":{"login":"carlossg","id":23651,"avatar_url":"https://avatars.githubusercontent.com/u/23651?v=3","gravatar_id":"","url":"https://api.github.com/users/carlossg","html_url":"https://github.com/carlossg","followers_url":"https://api.github.com/users/carlossg/followers","following_url":"https://api.github.com/users/carlossg/following{/other_user}","gists_url":"https://api.github.com/users/carlossg/gists{/gist_id}","starred_url":"https://api.github.com/users/carlossg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carlossg/subscriptions","organizations_url":"https://api.github.com/users/carlossg/orgs","repos_url":"https://api.github.com/users/carlossg/repos","events_url":"https://api.github.com/users/carlossg/events{/privacy}","received_events_url":"https://api.github.com/users/carlossg/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/usability","name":"area/usability","color":"bfe5bf"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/dependency/docker","name":"dependency/docker","color":"fbfa04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"saad-ali","id":10052848,"avatar_url":"https://avatars.githubusercontent.com/u/10052848?v=3","gravatar_id":"","url":"https://api.github.com/users/saad-ali","html_url":"https://github.com/saad-ali","followers_url":"https://api.github.com/users/saad-ali/followers","following_url":"https://api.github.com/users/saad-ali/following{/other_user}","gists_url":"https://api.github.com/users/saad-ali/gists{/gist_id}","starred_url":"https://api.github.com/users/saad-ali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saad-ali/subscriptions","organizations_url":"https://api.github.com/users/saad-ali/orgs","repos_url":"https://api.github.com/users/saad-ali/repos","events_url":"https://api.github.com/users/saad-ali/events{/privacy}","received_events_url":"https://api.github.com/users/saad-ali/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/11","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/milestones/v1.0-post","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/11/labels","id":1035380,"number":11,"title":"v1.0-post","description":"Things that are triaged and decided not for inclusion to v1.0","creator":{"login":"brendandburns","id":5751682,"avatar_url":"https://avatars.githubusercontent.com/u/5751682?v=3","gravatar_id":"","url":"https://api.github.com/users/brendandburns","html_url":"https://github.com/brendandburns","followers_url":"https://api.github.com/users/brendandburns/followers","following_url":"https://api.github.com/users/brendandburns/following{/other_user}","gists_url":"https://api.github.com/users/brendandburns/gists{/gist_id}","starred_url":"https://api.github.com/users/brendandburns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendandburns/subscriptions","organizations_url":"https://api.github.com/users/brendandburns/orgs","repos_url":"https://api.github.com/users/brendandburns/repos","events_url":"https://api.github.com/users/brendandburns/events{/privacy}","received_events_url":"https://api.github.com/users/brendandburns/received_events","type":"User","site_admin":false},"open_issues":183,"closed_issues":23,"state":"open","created_at":"2015-03-23T22:54:17Z","updated_at":"2015-06-04T04:36:33Z","due_on":null,"closed_at":null},"comments":18,"created_at":"2014-11-26T17:00:08Z","updated_at":"2015-06-04T05:57:44Z","closed_at":null,"body":"The emptyDir volumeMount is owned by root:root and permissions set to 750\r\nhostDir is the same but with 755 permissions\r\n\r\nContainers running with a non-root USER can't access the volumes\r\n\r\nRelated discussion at https://groups.google.com/forum/#!topic/google-containers/D5NdjKFs6Cc\r\nand Docker issue https://github.com/docker/docker/issues/9360 "},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/108738396","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-108738396","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630","id":108738396,"user":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"created_at":"2015-06-04T05:57:44Z","updated_at":"2015-06-04T05:57:44Z","body":"I don't really like the heuristics here.  I acknowledge that I suggested a\nheuristic but that was half a year ago :)\n\nOther than Docker support not being done yet, why can't we do something\nlike:\n\n1. All volumes get allocated a unique GID (maybe machine-unique or maybe\nmaster-allocated?)\n2. All volumes are mounted g+srwx\n3. All containers in a pod get all volumes in that pod's GIDs in their\nsupplemental groups\n\nNet result should be that all containers in the pod can access all volumes\nin the pod without restriction, regardless of what UID each container is\nusing.\n\nI don't know anything about SELinux labels, might be a problem.  I assert\nthat all volumes in a pod should be available to all containers\n\nNext we have to define \"all volumes\".  emptyDir is pretty obvious.  What\nhappens to hostPath mounts that did not exist and were created for this\nuse?  Seems reasonable.  What about hostPath mounts that existed before\nthis use - no way can we change those.  What about things like PDs?  Do we\nrun a recursive chown/chgrp/chmod  Blech.\n\n@mrunalp for docker support status on supplemental groups.\n"}}