[feature request] plugin configuration level privileged mode about nomad-driver-containerd HOT 3 CLOSED

Oh yes I meant to preserve current behavior, so allow_privileged = true by default.

But the ability to disable it on a plugin level would be great.

from nomad-driver-containerd.

@Oloremo
While I understand the concern, privileged is provided as an option in mostly all orchestration systems e.g. k8s or nomad docker driver

It's useful if you want to run system jobs that require elevated privileges.
While we cannot remove the privileged option (That will break backward compatibility), I don't see a concern with implementing your suggestion.

We can introduce allow_privileged (default: true) as a plugin level configuration to override privileged at the TaskConfig level.

plugin "containerd-driver" {
  config {
    enabled = true
    containerd_runtime = "io.containerd.runc.v2"
    stats_interval = "5s"
    allow_privileged = false
  }
}

With the above settings, even if someone is launching jobs with privileged=true, containerd-driver will deny launching the container based on allow_privileged=false at the plugin level.

from nomad-driver-containerd.

@Oloremo
aah, my bad! Added as a feature request.

from nomad-driver-containerd.