{"action":"created","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/2498","labels_url":"https://api.github.com/repos/rancher/rancher/issues/2498/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/2498/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/2498/events","html_url":"https://github.com/rancher/rancher/issues/2498","id":114485471,"number":2498,"title":"Is it possible to run rancher agent without privileged access?","user":{"login":"funkytaco","id":1712205,"avatar_url":"https://avatars.githubusercontent.com/u/1712205?v=3","gravatar_id":"","url":"https://api.github.com/users/funkytaco","html_url":"https://github.com/funkytaco","followers_url":"https://api.github.com/users/funkytaco/followers","following_url":"https://api.github.com/users/funkytaco/following{/other_user}","gists_url":"https://api.github.com/users/funkytaco/gists{/gist_id}","starred_url":"https://api.github.com/users/funkytaco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/funkytaco/subscriptions","organizations_url":"https://api.github.com/users/funkytaco/orgs","repos_url":"https://api.github.com/users/funkytaco/repos","events_url":"https://api.github.com/users/funkytaco/events{/privacy}","received_events_url":"https://api.github.com/users/funkytaco/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-01T18:51:40Z","updated_at":"2015-11-02T03:56:06Z","closed_at":null,"body":"Is it possible to run rancher agent without privileged access? Rackspace uses AppArmor with their new Carina product (docker swarm, essentially).\r\n\r\nhttps://community.getcarina.com/t/whats-the-path-to-docker-sock-i-need-it-for-rancher-agent/45"},"comment":{"url":"https://api.github.com/repos/rancher/rancher/issues/comments/152905493","html_url":"https://github.com/rancher/rancher/issues/2498#issuecomment-152905493","issue_url":"https://api.github.com/repos/rancher/rancher/issues/2498","id":152905493,"user":{"login":"cloudnautique","id":1989084,"avatar_url":"https://avatars.githubusercontent.com/u/1989084?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudnautique","html_url":"https://github.com/cloudnautique","followers_url":"https://api.github.com/users/cloudnautique/followers","following_url":"https://api.github.com/users/cloudnautique/following{/other_user}","gists_url":"https://api.github.com/users/cloudnautique/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudnautique/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudnautique/subscriptions","organizations_url":"https://api.github.com/users/cloudnautique/orgs","repos_url":"https://api.github.com/users/cloudnautique/repos","events_url":"https://api.github.com/users/cloudnautique/events{/privacy}","received_events_url":"https://api.github.com/users/cloudnautique/received_events","type":"User","site_admin":false},"created_at":"2015-11-02T03:56:06Z","updated_at":"2015-11-02T03:56:06Z","body":"Hmm, we add --privileged because we bind mount in the docker socket of the host. Which essentially gives the container privileged access. We are making it explicit. Looking at the reference documents posted in the forum, it doesn't look like you could bind mount in the docker socket either. We will have to look into Carina a bit more to see what it would take. \r\n\r\n"}}