{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7961","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7961/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7961/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7961/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/7961","id":74420091,"number":7961,"title":"Run services as non-privileged users","user":{"login":"stephenR","id":211645,"avatar_url":"https://avatars.githubusercontent.com/u/211645?v=3","gravatar_id":"","url":"https://api.github.com/users/stephenR","html_url":"https://github.com/stephenR","followers_url":"https://api.github.com/users/stephenR/followers","following_url":"https://api.github.com/users/stephenR/following{/other_user}","gists_url":"https://api.github.com/users/stephenR/gists{/gist_id}","starred_url":"https://api.github.com/users/stephenR/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stephenR/subscriptions","organizations_url":"https://api.github.com/users/stephenR/orgs","repos_url":"https://api.github.com/users/stephenR/repos","events_url":"https://api.github.com/users/stephenR/events{/privacy}","received_events_url":"https://api.github.com/users/stephenR/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/12","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/milestones/v1.0-candidate","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/12/labels","id":1086011,"number":12,"title":"v1.0-candidate","description":"These are candidates for inclusion to v1.0 but will be pushed to v1.0-bubble if they're triaged as not meeting the v1.0 bar as a required launch blocker.","creator":{"login":"alex-mohr","id":8729097,"avatar_url":"https://avatars.githubusercontent.com/u/8729097?v=3","gravatar_id":"","url":"https://api.github.com/users/alex-mohr","html_url":"https://github.com/alex-mohr","followers_url":"https://api.github.com/users/alex-mohr/followers","following_url":"https://api.github.com/users/alex-mohr/following{/other_user}","gists_url":"https://api.github.com/users/alex-mohr/gists{/gist_id}","starred_url":"https://api.github.com/users/alex-mohr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex-mohr/subscriptions","organizations_url":"https://api.github.com/users/alex-mohr/orgs","repos_url":"https://api.github.com/users/alex-mohr/repos","events_url":"https://api.github.com/users/alex-mohr/events{/privacy}","received_events_url":"https://api.github.com/users/alex-mohr/received_events","type":"User","site_admin":false},"open_issues":19,"closed_issues":10,"state":"open","created_at":"2015-04-27T19:03:36Z","updated_at":"2015-05-09T09:43:08Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-05-08T16:34:44Z","updated_at":"2015-05-10T15:41:01Z","closed_at":null,"body":"At the moment most services in kubernetes run as root. This includes (from glancing at ps aux on a minion):\r\n* etcd\r\n* kube2sky\r\n* td-agent\r\n* skydns\r\n* elasticsearch\r\n* heapster\r\n\r\nIt's best practice to use non-root user accounts for services that don't need them. E.g. elasticsearch had remote code execution vulnerabilities in the past.\r\nEven though docker's root has a capability bounding set applied so it doesn't translate to a real root on the host, the attack surface for privilege escalation attacks is still increased."},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/100657965","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/7961#issuecomment-100657965","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7961","id":100657965,"user":{"login":"thockin-cc","id":11747855,"avatar_url":"https://avatars.githubusercontent.com/u/11747855?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin-cc","html_url":"https://github.com/thockin-cc","followers_url":"https://api.github.com/users/thockin-cc/followers","following_url":"https://api.github.com/users/thockin-cc/following{/other_user}","gists_url":"https://api.github.com/users/thockin-cc/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin-cc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin-cc/subscriptions","organizations_url":"https://api.github.com/users/thockin-cc/orgs","repos_url":"https://api.github.com/users/thockin-cc/repos","events_url":"https://api.github.com/users/thockin-cc/events{/privacy}","received_events_url":"https://api.github.com/users/thockin-cc/received_events","type":"User","site_admin":false},"created_at":"2015-05-10T15:41:01Z","updated_at":"2015-05-10T15:41:01Z","body":"More or less, yeah. I think we have a responsibility as thought leaders to\npush this direction. There's no reason to do a allow low-ports for non-priv\npods (namespaces) or for privileged net=host pods.\nOn May 10, 2015 7:54 AM, \"Eric Tune\" <notifications@github.com> wrote:\n\n> @thockin <https://github.com/thockin> I think you have given this issue\n> some thought. What did you want to do about low numbered ports? Run stuff\n> as non root and make it easy to get CAP_NET_BIND?\n>\n> @pweil- <https://github.com/pweil-> @pmorie <https://github.com/pmorie>\n> what does OpenShift do about CAP_NET_BIND and default Capabilities for\n> SecurityContexts?\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/GoogleCloudPlatform/kubernetes/issues/7961#issuecomment-100652823>\n> .\n>\n"}}