Merge pull request kubernetes#135 from diegs/setcap

Add CAP_NET_BIND_SERVICE to hyperkube.
kinvolk · May 18, 2017 · bc000d3 · bc000d3
2 parents 70bc093 + 2398096
commit bc000d3
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/cluster/images/hyperkube/Dockerfile b/cluster/images/hyperkube/Dockerfile
@@ -91,3 +91,6 @@ RUN ln -s /hyperkube /apiserver \
 
 # Copy the hyperkube binary
 COPY hyperkube /hyperkube
+
+# Add CAP_NET_BIND_SERVICE to hyperkube so it can bind privileged ports as non-root.
+RUN setcap cap_net_bind_service=+ep /hyperkube