Fix pause container of a privileged pod unable to start due to /sys mount option mismatch#2760
Merged
Merged
Conversation
micromaomao
force-pushed
the
pause-container-sysfs
branch
2 times, most recently
from
eefdbba to
a10d1a1
Compare
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds an IsSandboxContainer flag to CreateContainerOptions and threads it through the Rego policy enforcer so that the framework policy can special-case a /sys rw mount on the CRI pod sandbox (pause) container when the policy allows any elevated containers.
Changes:
- New
IsSandboxContainerfield onCreateContainerOptions, populated fromc.isSandboxinHost.CreateContainerand forwarded into the Rego input. - New
mount_okrule inframework.regothat permits a sysfs rw/sysmount for the sandbox container when at least one candidate container hasallow_elevated. - Tests covering sandbox vs. non-sandbox, ro/rw combinations, and the privileged-request-denied case.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/securitypolicy/securitypolicyenforcer.go | Adds IsSandboxContainer field with doc comment. |
| pkg/securitypolicy/securitypolicyenforcer_rego.go | Plumbs the flag through V1 wrapper and into the Rego input map. |
| pkg/securitypolicy/framework.rego | New mount_ok rule for sandbox sysfs rw carve-out; minor whitespace cleanup. |
| pkg/securitypolicy/regopolicy_linux_test.go | New tests for sandbox sysfs carve-out behavior. |
| internal/guest/runtime/hcsv2/uvm.go | Switches to EnforceCreateContainerPolicyV2 and supplies IsSandboxContainer: c.isSandbox. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
micromaomao
force-pushed
the
pause-container-sysfs
branch
2 times, most recently
from
e931899 to
a49098b
Compare
anmaxvl
approved these changes
Jun 2, 2026
Member
Author
|
@anmaxvl don't forget to merge |
helsaawy
approved these changes
Jun 16, 2026
…ount option mismatch Starting with v2, containerd mounts /sys as rw on the sandbox container when the pod is privileged (1fc497218 "Fix privileged container sysfs can't be rw because pod is ro by default") instead of ro. This means that the mount list for a privileged pause container no longer matches with just data.defaultMounts and will need a special case for sysfs. Alternative options were also considered - see the comment in framework.rego. This change in GCS is necessary even though this can be fixed via a policy change, because we need to maintain compatibility with existing policies. This PR converts EnforceCreateContainerPolicy in the LCOW GCS to EnforceCreateContainerPolicyV2, in order to use the CreateContainerOptions struct to pass an additional bool indicating whether the current container is a sandbox container. This does not allow additional capabilities etc for the sandbox container, only that sysfs can now be rw. Assisted-by: GitHub Copilot:claude-opus-4.7 Signed-off-by: Tingmao Wang <tingmaowang@microsoft.com>
Assisted-by: GitHub Copilot:claude-opus-4.7 Signed-off-by: Tingmao Wang <tingmaowang@microsoft.com>
…for sysfs rw special case Signed-off-by: Tingmao Wang <tingmaowang@microsoft.com>
… container in the policy is elevated Assisted-by: GitHub Copilot copilot-review Signed-off-by: Tingmao Wang <tingmaowang@microsoft.com>
micromaomao
force-pushed
the
pause-container-sysfs
branch
from
18fb719 to
3f3657f
Compare
micromaomao
commented
Jun 17, 2026
micromaomao
left a comment
micromaomao
left a comment
Member
Author
There was a problem hiding this comment.
I've removed the
some c in candidate_containers
c.allow_elevated
clause since even when a policy does not allow any elevated containers, some future fragments might do, Noticed in testing, fix pushed.
anmaxvl
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Starting with v2, containerd mounts /sys as rw on the sandbox container when the
pod is privileged (1fc497218 "Fix privileged container sysfs can't be rw because
pod is ro by default") instead of ro. This means that the mount list for a
privileged pause container no longer matches with just data.defaultMounts and
will need a special case for sysfs. Alternative options were also considered -
see the comment in framework.rego.
This change in GCS is necessary even though this can be fixed via a policy
change, because we need to maintain compatibility with existing policies.
This PR converts EnforceCreateContainerPolicy in the LCOW GCS to
EnforceCreateContainerPolicyV2, in order to use the CreateContainerOptions
struct to pass an additional bool indicating whether the current container is a
sandbox container.
This does not allow additional capabilities etc for the sandbox container, only
that sysfs can now be rw.
Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Tingmao Wang tingmaowang@microsoft.com