mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
Benjamin Elder
8fbc580e94
atelet performs no privilege-requiring host operations: no mounts, netlink,
nftables, device access, or namespace manipulation (all of that lives in the
ateom worker pod). It only reads/writes the /var/lib/ateom-gvisor hostPath as
root, so it needs no Linux capabilities. Replace privileged:true with
runAsUser/runAsGroup 0 and capabilities drop ALL. runAsUser is pinned explicitly
so the root requirement no longer depends on the base image's default user.
Unpacking arbitrary actor images can require writing into image-defined
read-only directories (e.g. ko ships /ko-app as 0555), which root cannot do
without CAP_DAC_OVERRIDE. Instead of granting that cap:
- untar extracts directories owner-writable, then restores the image's modes
in a final pass (deepest-first), so directory and file modes are preserved
faithfully.
- bundle removal uses removeAllWritable, which re-adds owner write to each
directory before unlinking, so atelet can also delete a restored read-only
tree as plain root.
Validated end-to-end on a kind cluster.