{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/2630","id":50202938,"number":2630,"title":"Volumes are created in container with root ownership and strict permissions","user":{"login":"carlossg","id":23651,"avatar_url":"https://avatars.githubusercontent.com/u/23651?v=3","gravatar_id":"","url":"https://api.github.com/users/carlossg","html_url":"https://github.com/carlossg","followers_url":"https://api.github.com/users/carlossg/followers","following_url":"https://api.github.com/users/carlossg/following{/other_user}","gists_url":"https://api.github.com/users/carlossg/gists{/gist_id}","starred_url":"https://api.github.com/users/carlossg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carlossg/subscriptions","organizations_url":"https://api.github.com/users/carlossg/orgs","repos_url":"https://api.github.com/users/carlossg/repos","events_url":"https://api.github.com/users/carlossg/events{/privacy}","received_events_url":"https://api.github.com/users/carlossg/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/usability","name":"area/usability","color":"bfe5bf"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/dependency/docker","name":"dependency/docker","color":"fbfa04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"saad-ali","id":10052848,"avatar_url":"https://avatars.githubusercontent.com/u/10052848?v=3","gravatar_id":"","url":"https://api.github.com/users/saad-ali","html_url":"https://github.com/saad-ali","followers_url":"https://api.github.com/users/saad-ali/followers","following_url":"https://api.github.com/users/saad-ali/following{/other_user}","gists_url":"https://api.github.com/users/saad-ali/gists{/gist_id}","starred_url":"https://api.github.com/users/saad-ali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saad-ali/subscriptions","organizations_url":"https://api.github.com/users/saad-ali/orgs","repos_url":"https://api.github.com/users/saad-ali/repos","events_url":"https://api.github.com/users/saad-ali/events{/privacy}","received_events_url":"https://api.github.com/users/saad-ali/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/11","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/milestones/v1.0-post","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/11/labels","id":1035380,"number":11,"title":"v1.0-post","description":"Things that are triaged and decided not for inclusion to v1.0","creator":{"login":"brendandburns","id":5751682,"avatar_url":"https://avatars.githubusercontent.com/u/5751682?v=3","gravatar_id":"","url":"https://api.github.com/users/brendandburns","html_url":"https://github.com/brendandburns","followers_url":"https://api.github.com/users/brendandburns/followers","following_url":"https://api.github.com/users/brendandburns/following{/other_user}","gists_url":"https://api.github.com/users/brendandburns/gists{/gist_id}","starred_url":"https://api.github.com/users/brendandburns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendandburns/subscriptions","organizations_url":"https://api.github.com/users/brendandburns/orgs","repos_url":"https://api.github.com/users/brendandburns/repos","events_url":"https://api.github.com/users/brendandburns/events{/privacy}","received_events_url":"https://api.github.com/users/brendandburns/received_events","type":"User","site_admin":false},"open_issues":191,"closed_issues":27,"state":"open","created_at":"2015-03-23T22:54:17Z","updated_at":"2015-06-07T21:13:43Z","due_on":null,"closed_at":null},"comments":52,"created_at":"2014-11-26T17:00:08Z","updated_at":"2015-06-08T02:00:08Z","closed_at":null,"body":"The emptyDir volumeMount is owned by root:root and permissions set to 750\r\nhostDir is the same but with 755 permissions\r\n\r\nContainers running with a non-root USER can't access the volumes\r\n\r\nRelated discussion at https://groups.google.com/forum/#!topic/google-containers/D5NdjKFs6Cc\r\nand Docker issue https://github.com/docker/docker/issues/9360 "},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/109826656","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-109826656","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/2630","id":109826656,"user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"created_at":"2015-06-08T02:00:08Z","updated_at":"2015-06-08T02:00:08Z","body":"@thockin :'-/\n\nOn Sun, Jun 7, 2015 at 8:54 PM, Tim Hockin <notifications@github.com> wrote:\n\n> Hmm, I thought docker allowed setting GID. Damn.\n>\n> On Jun 7, 2015 1:23 PM, \"Paul Morie\" <notifications@github.com> wrote:\n>\n> > It doesn't look like docker exposed control of the group at all yet. Am i\n> > missing something, @thockin? Would the kubelet have to setgid on the\n> > container process? Sounds racy to me.\n> > On Sun, Jun 7, 2015 at 3:22 PM Paul Morie <pmorie@gmail.com> wrote:\n> >\n> > > Hrm\n> > > On Sun, Jun 7, 2015 at 2:25 PM Clayton Coleman <\n> notifications@github.com\n> > >\n> > > wrote:\n> > >\n> > >> Treat it like 700 - if labels are different you can't see it, if they\n> > are\n> > >> you can.\n> > >>\n> > >> In this context we're probably going to stay simple and say every\n> volume\n> > >> has a single label, and every container has a single label, and we\n> want\n> > >> everything in the pod to have the same label in 99% of cases.\n> > Eventually we\n> > >> may want a container to have a different label (which means it can\n> > access\n> > >> anything outside of its label, period).\n> > >>\n> > >> > On Jun 7, 2015, at 2:21 PM, thockin-cc <notifications@github.com>\n> > >> wrote:\n> > >> >\n> > >> > Yeah, I don't know selinux at all (it has only ever given me\n> problems\n> > >> that\n> > >> > I don't know how to solve - same as here).\n> > >> > On Jun 7, 2015 11:05 AM, \"Clayton Coleman\" <\n> notifications@github.com>\n> > >> wrote:\n> > >> >\n> > >> > > I agree group is generally useful. It wouldn't work for labels\n> > >> though.\n> > >> > >\n> > >> > > > On Jun 7, 2015, at 1:50 PM, Tim Hockin <\n> notifications@github.com>\n> > >> > > wrote:\n> > >> > > >\n> > >> > > > Can't we make it 0770 and set the group ID for it and every\n> > >> container in\n> > >> > > > the pod? It's coarse but better than 0777 and closer to where we\n> > >> should\n> > >> > > go\n> > >> > > > (IMO supplemental GIDs). As far as I see, Security Context does\n> > not\n> > >> yet\n> > >> > > > allow a container to set GID...\n> > >> > > > On Jun 5, 2015 3:01 PM, \"Paul Morie\" <notifications@github.com>\n> > >> wrote:\n> > >> > > >\n> > >> > > > > My bad. I meant, make emptyDir 0777 instead of 0700.\n> > >> > > > >\n> > >> > > > > —\n> > >> > > > > Reply to this email directly or view it on GitHub\n> > >> > > > > <\n> > >> > >\n> > >>\n> >\n> https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-109452834\n> > >\n> > >>\n> > >> > >\n> > >> > > > > .\n> > >> > > > >\n> > >> > > > —\n> > >> > > > Reply to this email directly or view it on GitHub.\n> > >> > > >\n> > >> > >\n> > >> > > —\n> > >> > > Reply to this email directly or view it on GitHub\n> > >> > > <\n> > >>\n> >\n> https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-109784566\n> > >\n> > >>\n> > >> > > .\n> > >> > >\n> > >> > —\n> > >> > Reply to this email directly or view it on GitHub.\n> > >> >\n> > >>\n> > >> —\n> > >> Reply to this email directly or view it on GitHub\n> > >> <\n> >\n> https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-109785941\n> > >\n> > >> .\n> > >>\n> > >\n> >\n> > —\n> > Reply to this email directly or view it on GitHub\n> > <\n> https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-109797284\n> >\n> > .\n> >\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/GoogleCloudPlatform/kubernetes/issues/2630#issuecomment-109819177>\n> .\n>\n"}}