KubeArmor
KubeArmor copied to clipboard
mount procfs instead of using hostpid
Feature Request
KubeArmor needs access to host's procfs to stich container and real time process information we get from eBPF.
Is your feature request related to a problem? Please describe the use case.
Sharing pid ns with host is more risky than just accessing procfs.
Describe the solution you'd like
- We can mount and set procfs to readonly maybe alleviating a lot of risks involded with mounting procfs
- Add configuration in KubeArmor to support custom path prefix for procfs
Related #1186
@daemon1024 is the issue open to work?
Yes @yp969803
/assign