helm
helm copied to clipboard
remove /proc/sysrq-trigger mount, default host namespaces true
Background
- Gremlin currently allows a host shutdown in two different ways: using a
/proc/sysrq-trigger
, and issuing a shutdown from the host'sPID
namespace. Only the latter is documented, and the former performs a non-graceful shutdown (which isn't documented in Gremlin). - At the same time,
hostPID=true
has become a requirement for all container drivers except for the legacydocker
driver. It makes sense to flip this totrue
to minimize issues at install time resulting from incorrect arguments.-
hostNetwork
is in the same situation, though unrelated to shutdown attacks.
-
Change
- Remove mount of
/proc/sysrq-trigger
which disables this functionality in Gremlin - default
hostPID=true
to enable host attacks without sysrq - while we're at it, default
hostNetwork=true
as well, since it is required for reliability management features.