{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5095","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5095/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5095/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5095/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/5095","id":59980117,"number":5095,"title":"Allow setting some \"safe\" per-container sysctls","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/isolation","name":"area/isolation","color":"aba420"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/kubelet-api","name":"area/kubelet-api","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-03-05T16:52:59Z","updated_at":"2015-07-02T16:18:55Z","closed_at":null,"body":"A GCE ContainerVM used on IRC asked how to set SOMAXCONN within his container.\r\nThat is not possible in an unprivileged container because `/proc/sys` is not writeable.\r\n\r\nIf the user tries to set `containerManifest.containers[i].privileged=true` then a validation error occurs.\r\nI can't tell if that validation error is occuring only at the kubelet or also at some layer of the containerVM system.  At any rate, the user would at least need to set `--allow_privileged=true` on the kubelet.  Not sure if that is possible with ContainerVM.\r\n\r\nFor kubernetes, we would not want the user to have to set a blanket allow_privileged on kubelet and apiserver just to tune this parameter.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/118082928","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/5095#issuecomment-118082928","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/5095","id":118082928,"user":{"login":"edevil","id":12426,"avatar_url":"https://avatars.githubusercontent.com/u/12426?v=3","gravatar_id":"","url":"https://api.github.com/users/edevil","html_url":"https://github.com/edevil","followers_url":"https://api.github.com/users/edevil/followers","following_url":"https://api.github.com/users/edevil/following{/other_user}","gists_url":"https://api.github.com/users/edevil/gists{/gist_id}","starred_url":"https://api.github.com/users/edevil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edevil/subscriptions","organizations_url":"https://api.github.com/users/edevil/orgs","repos_url":"https://api.github.com/users/edevil/repos","events_url":"https://api.github.com/users/edevil/events{/privacy}","received_events_url":"https://api.github.com/users/edevil/received_events","type":"User","site_admin":false},"created_at":"2015-07-02T16:18:55Z","updated_at":"2015-07-02T16:18:55Z","body":"Any progress on this?"}}