privileged container's disk attribute is ro because the namespace of pause is added

[fengwei0328]

What happened:

When I create the container, privileged is turned on, but since the pause container sysfs is ro, my privileged container is also ro

What you expected to happen:

Hopefully, in the case of non-bind, the sysfs of the privileged container is rw

How to reproduce it (as minimally and precisely as possible):

pod.json

{
    "metadata": {
        "name": "privileged-pod",
	"namespace": "k8s.io",
	"uid": "hdishd83djaidwnduwk28bcsb"
    },
    "command": [
        "top"
    ],
    "log_directory": "/var/log/pods",
    "linux": {
	    "security_context": {
            	"privileged": true
            }
 

container.json

{
    "metadata": {
        "name": "busybox-200-3"
    },
    "image": {
        "image": "docker.io/library/busybox"
    },
    "command": [
        "top"
    ],

    "tty": true,
    "stdin": true,
    "log_path": "busybox-200-3.log",
    "mounts":[
    	{
	    "container_path": "/sys",
            "host_path": "/sys"
	}
    ],
    "linux": {
	    "security_context": {
            	"privileged": true
 

In container

/ # mount | grep  sysfs
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)

container's config.json:

{
            "destination": "/sys",
            "type": "sysfs",
            "source": "sysfs",
            "options": [
                "nosuid",
                "noexec",
                "nodev",
                "rw"
            ]
        },

because pod's config.json:

{
            "destination": "/sys",
            "type": "sysfs",
            "source": "sysfs",
            "options": [
                "nosuid",
                "noexec",
                "nodev",
                "ro"
            ]
        },

Anything else we need to know?:

Environment:

• Container runtime or hardware configuration:
• OS (e.g: cat /etc/os-release):
• Kernel (e.g. uname -a):
• Others: