Kubernetes8 min readintermediate
Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions
Summary
Kubernetes v1.37 adds two alpha‑level storage hardening knobs: per‑volume `bindMountOptions` (e.g. noexec, nosuid, nodev) that affect the bind‑mount the runtime creates, and an `emptyDir` `mode` field to set Unix permission bits (including the sticky bit). Together they let you enforce least‑privilege policies on writable volumes without init‑containers or CSI tricks.
- Bind‑mount flags are now configurable per volume via `bindMountOptions`, covering emptyDir, PVs, ConfigMaps, Secrets, etc.; they are enforced by the container runtime and rejected on unsupported nodes.
- `emptyDir.mode` lets you set directory permissions (e.g. 01777 for sticky‑bit /tmp semantics or 0750 for tighter access) directly in the pod spec.
- Both features are behind the `VolumeBindMountOptions` and `EmptyDirVolumeMode` alpha gates; enable them on the API server and kubelet to use.
- The changes address long‑standing security findings (e.g., inability to set noexec on emptyDir) and simplify compliance with benchmarks that require sticky‑bit or no‑exec mounts.
Writable volumes are a common attack surface in containers. Without `noexec`/`nosuid`/`nodev` flags, a compromised pod can drop binaries onto a shared volume and run them even with a read‑only root filesystem, breaking isolation guarantees. Likewise, the default 0777 mode on `emptyDir` lets any con…
6/10
