Repository navigation
microvm: forward sysctls and lift the guest's privileged-port limit to match gVisor - #1904
Open
Davanum Srinivas (dims) wants to merge 3 commits into
Open
Davanum Srinivas (dims) wants to merge 3 commits into
Davanum Srinivas (dims) wants to merge 3 commits into
Conversation
Davanum Srinivas (dims)
marked this pull request as ready for review
September 25, 2026 23:52
Davanum Srinivas (dims)
marked this pull request as draft
September 26, 2026 02:19
Davanum Srinivas (dims)
changed the title
This was referenced Sep 26, 2026
Davanum Srinivas (dims)
force-pushed
the
pr/microvm-sysctls
branch
3 times, most recently
from
September 27, 2026 02:00
3eb0b33 to
4c25c22
Compare
Davanum Srinivas (dims)
marked this pull request as ready for review
September 27, 2026 02:25
Collaborator
Author
Collaborator
we have no back compat right now and aggressively prefer the approach that is more correct / maintainable long-term than accruing halfway compat attempts |
Collaborator
Author
|
thanks Tim Hockin (@thockin) Benjamin Elder (@BenTheElder) i've removed backward compat stuff. |
Bowei Du (bowei)
added
area/security
Maya Wang (mayawang)
left a comment
Maya Wang (mayawang)
left a comment
Collaborator
There was a problem hiding this comment.
Code looks good. One question on where these two settings live, following Ben's note above.
Davanum Srinivas (dims)
force-pushed
the
pr/microvm-sysctls
branch
from
October 1, 2026 11:43
4c25c22 to
1fc797b
Compare
Davanum Srinivas (dims)
changed the title
Davanum Srinivas (dims)
force-pushed
the
pr/microvm-sysctls
branch
from
October 1, 2026 12:04
1fc797b to
f605f1e
Compare
2 tasks done
Davanum Srinivas (dims)
force-pushed
the
pr/microvm-sysctls
branch
4 times, most recently
from
October 17, 2026 11:59
fda5193 to
8bfff79
Compare
Davanum Srinivas (dims)
changed the title
Collaborator
Author
|
thanks Benjamin Elder (@BenTheElder) fixed this up as #2361 merged |
Davanum Srinivas (dims)
force-pushed
the
pr/microvm-sysctls
branch
from
October 17, 2026 12:21
8bfff79 to
7b55bd9
Compare
The agent honors sysctls, and net.* keys need no network namespace of their own, which is what ateom-microvm produces.
Set net.ipv4.ip_unprivileged_port_start=0 in ShapeMicroVM. gVisor has no privileged-port check and runsc ignores this sysctl, so only the guest kernel needs it.
The probe listens on port 80, so a caps-none template proves the bind on both runtimes. The probe also reports NoNewPrivs; neither runtime sets it, and gVisor runs with --allow-suid.
Davanum Srinivas (dims)
force-pushed
the
pr/microvm-sysctls
branch
from
October 18, 2026 21:03
7b55bd9 to
e837880
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A micro-VM container that drops
NET_BIND_SERVICEcould not bind a port below 1024; the same container on gVisor could, since its network stack has no privileged-port limit.The kata agent now receives the spec's sysctls, and ShapeMicroVM sets
net.ipv4.ip_unprivileged_port_start=0, so both runtimes behave the same. Neither setsno_new_privileges; gVisor runs with--allow-suidsince #2361, so setuid binaries work on both.The capabilities e2e suite gains a drop-ALL template whose probe listens on port 80, and the probe reports
NoNewPrivs, asserted off on both lanes.go test -race ./internal/ocispec/...,GOOS=linux go veton kata and ocispec,go vet ./internal/e2e/...; e2e on both lanes in CI.