miki3421 opened a new issue, #273: URL: https://github.com/apache/openserverless/issues/273
The 0.9.0 builder security backport retains Kubernetes user namespaces (`hostUsers: false`), a non-privileged rootless worker, no service-account token and the BuildKit process sandbox. Kind must support legitimate builds without disabling those protections. In an isolated lab with Kind 0.30.0, Kubernetes 1.33.1, containerd 2.1.1 and Linux 6.8.0-146, a valid build is accepted but fails before the worker starts: `mounting sysfs ... operation not permitted`. A minimal BusyBox pod with `hostUsers: false` reproduces it; the equivalent ordinary pod succeeds. Related upstream investigation: https://github.com/kubernetes-sigs/kind/issues/3436. An initial read-only sysfs mount inside the Kind node clears the sandbox mount failure and exposes a second error: `/kind/bin/mount-product-files.sh: permission denied`; the node's `/kind` directory is mode 0644. This is still under test, not a completed compatibility fix. Acceptance: a valid base-image and dependency build completes and pushes to the authenticated lab registry; the resulting image can run an action; malformed and cross-tenant targets remain rejected; worker user namespaces, non-privileged mode, token exclusion and process sandbox remain enabled. Node setup must be repeatable and survive node restart without granting workers access to the host Docker socket or host paths. Related security backports: - https://github.com/apache/openserverless-admin-api/pull/60 - https://github.com/apache/openserverless-task/pull/237 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
