support containers running as non-privileged user about ksniff HOT 7 CLOSED

@adipascu add "-p" to your command line to invoke ksniff in privileged mode

from ksniff.

@eldadru would this workaround help? https://github.com/jordanwilson230/kubectl-plugins#kubectl-ssh

from ksniff.

Hi @jordanwilson230 I finally have the time to work on this issue,
I would like ksniff to also support scratch containers so i will use similar approach to what kubectl-ssh does except I won't exec into the target container but attach to his network namespace and perform the actual sniffing on the attached container.

from ksniff.

Completed as part of #30 , please play with it, test it and report bugs :)

from ksniff.

I am getting static-tcpdump: any: You don't have permission to capture on that device on a nginx container that defaults to running as the www-data user.

I am running knsiff 1.3.1

from ksniff.

Thanks! @eldadru why not do it privileged by default?

from ksniff.

@adipascu add "-p" to your command line to invoke ksniff in privileged mode

Getting the following error message:

ERRO[0000] failed to create privileged pod on node: 'minikube'  error="pods \"ksniff-vjtdw\" is forbidden: violates PodSecurity \"baseline:latest\": host namespaces (hostPID=true), hostPath volumes (volumes \"host\", \"container-socket\"), privileged (container \"ksniff-privileged\" must not set securityContext.privileged=true)"
Error: pods "ksniff-vjtdw" is forbidden: violates PodSecurity "baseline:latest": host namespaces (hostPID=true), hostPath volumes (volumes "host", "container-socket"), privileged (container "ksniff-privileged" must not set securityContext.privileged=true)

K8s version: v1.23.3

from ksniff.