Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions
Kubernetes v1.37 adds alpha support for bindMountOptions on volume mounts, letting users set noexec, nosuid and nodev on the bind mount the container runtime creates. It also adds an alpha mode field for emptyDir volumes, so permissions such as 01777 or 0750 can be set natively instead of via init containers. Both features sit behind the VolumeBindMountOptions and EmptyDirVolumeMode feature gates.
What changes for platform teams
Platform teams can enforce noexec and sticky-bit emptyDir permissions in pod specs, but must enable both alpha gates on the API server and kubelet and confirm runtimes advertise the mount_options runtime feature, since kubelets reject pods on nodes lacking support.
Read the original at Kubernetes Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules