Issue
We have a container in a pod that runs with privileged mode (i.e. has spec.containers[].securityContext.privilege = true). We are moving it from privileged mode to use more tailored capabilities. One of the things it does, though, is to enable IP forwarding by editing /proc/sys/net/ipv4/ip_forward:
echo 1 >|/proc/sys/net/ipv4/ip_forward
Now that the pod is not privileged anymore, it fails with this message:
/usr/local/bin/start.sh: line 20: /proc/sys/net/ipv4/ip_forward: Read-only file system
Is there some specific capability that would allow us to write to /proc/sys/* files?
Solution
Unprivileged containers mount /proc read-only, which prevents them from enabling net.ipv4.ip\_forward in their own network namespace. This GitHub issue provides a workaround for this limitation.
Any configuration changes made using the echo command disappear when the system is restarted. To ensure that the configuration changes take effect after a system reboot, use sysctl commands. Refer to the document for using the sysctl command to modify the parameters of ip_forward.
If you need to change parameters in /proc/sys, the best thing to do is edit /etc/sysctl.conf and then run sysctl -p. This ensures that your changes will persist across reboots.
Answered By - Srividya Answer Checked By - Mary Flores (WPSolving Volunteer)