Skip to content

Enable enable_unprivileged_ports and enable_unprivileged_icmp #4545

Closed
@olljanat

Description

@olljanat

Is your feature request related to a problem? Please describe.
Pod running as non-root cannot listen ports <=1024 and pods without CAP_NET_RAW capability cannot use ICMP.

Describe the solution you'd like
Just released containerd 1.6.0-beta.3 added support for enable_unprivileged_ports and enable_unprivileged_icmp CRI options but unfortunately there was no consensus to enable those by default before containerd version 2.0 which why those need to be enabled on here.

Describe alternatives you've considered
Of course those can be also added as option on here too but most probably it is not needed as anyway containerd version is not raised to 1.6 before also K8s is raised to 1.23.0

Additional context

Backporting

  • Needs backporting to older releases

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions