{"comment":{"url":"https://api.github.com/repos/csrwng/kubernetes/comments/9702675","html_url":"https://github.com/csrwng/kubernetes/commit/2b01746104211797ccd516bae59d996acd33caca#commitcomment-9702675","id":9702675,"user":{"login":"csrwng","id":5834976,"avatar_url":"https://avatars.githubusercontent.com/u/5834976?v=3","gravatar_id":"","url":"https://api.github.com/users/csrwng","html_url":"https://github.com/csrwng","followers_url":"https://api.github.com/users/csrwng/followers","following_url":"https://api.github.com/users/csrwng/following{/other_user}","gists_url":"https://api.github.com/users/csrwng/gists{/gist_id}","starred_url":"https://api.github.com/users/csrwng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csrwng/subscriptions","organizations_url":"https://api.github.com/users/csrwng/orgs","repos_url":"https://api.github.com/users/csrwng/repos","events_url":"https://api.github.com/users/csrwng/events{/privacy}","received_events_url":"https://api.github.com/users/csrwng/received_events","type":"User","site_admin":false},"position":105,"line":176,"path":"docs/design/security_context.md","commit_id":"2b01746104211797ccd516bae59d996acd33caca","created_at":"2015-02-11T19:29:00Z","updated_at":"2015-02-11T19:29:00Z","body":"> You haven't said exactly how a Security Context is connected to a bound Pod. Is it part of the pod Spec? I'll assume so.\r\n\r\nThe security context is associated via the service account associated with the pod.\r\n\r\n> And you haven't said how private UID ranges are allocated, with respect to a global user registry such as LDAP\r\n\r\nA finalizer would take care of allocating the UID range for you before allowing the security context to be used.\r\n\r\n> You haven't said whether all containers in a Pod must have the same uid/gid mappings or different.\r\n\r\nBecause a security context is associated with a service account, it's associated with a Pod. Therefore all containers in a Pod would have the same uid/gid mappings. A Pod would at least need to be internally consistent with regards to ids."}}