# Kubernetes supports running kube-proxy in an unprivileged container

DevFeed: [Kubernetes supports running kube-proxy in an unprivileged container](<https://devfeed.tech/articles/kubernetes-supports-running-kube-proxy-in-an-unprivileged-container-17571.md>)

Original publisher: [Read original article](<https://www.kubernetes.dev/blog/2024/01/05/kube-proxy-non-privileged/>)

Author: The Kubernetes Authors

Published: 2024-01-05T00:00:00Z

Content type: tutorial

Language: en

Sources: [Kubernetes Contributors Blog](<https://devfeed.tech/sources/kubernetes-contributors-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Security](<https://devfeed.tech/topics/security.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Linux](<https://devfeed.tech/topics/linux.md>)

Tags: [configuration](<https://devfeed.tech/tags/configuration.md>), [containers](<https://devfeed.tech/tags/containers.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This post explains how kube-proxy's --init-only flag can perform privileged initialization in a separate init container, allowing the main kube-proxy container to run unprivileged with capabilities on Linux.

## Source excerpt

This post describes how the --init-only flag to kube-proxy can be used to run the main kube-proxy container in a stricter securityContext, by performing the configuration that requires privileged mode in a separate init container . Since Windows doesn't have the equivalent of capabilities, this only works on Linux. The kube-proxy Pod still only meets the privileged Pod Security Standard , but there is still an improvement because the running container doesn't need to run privileged. Please note that kube-proxy can be installed in different ways. The examples below assume that kube-proxy is run from a pod, but similar changes could be made in clusters where it is run as a system service. Background It is undesirable to run a server container like kube-proxy in privileged mode. Security aware users wants to use capabilities instead. If kube-proxy is installed as a POD, the initialization requires "privileged" mode, mostly for setting sysctl's. However, kube-proxy only tries to set the sysctl's if they don't already have the right values. In theory, then, if a privileged init container set the sysctls to the right values, then kube-proxy could run unprivileged. The problem is to know what to setup. Until now the only option has been to read the source to see what changes kube-proxy would have made, but with --init-only you can have kube-proxy itself do the setup exactly as on a normal start, and then exit. Initializing kube-proxy in an init container The example manifests below are not complete, but narrowed down to what is essential to illustrate the function. Usually, cluster operators run kube-proxy in a privileged security context. apiVersion: apps/v1 kind: DaemonSet metadata: labels: k8s-app: kube-proxy spec: template: spec: containers: - name: kube-proxy command: - /usr/local/bin/kube-proxy - --config=/var/lib/kube-proxy/config.conf - --hostname-override=$(NODE_NAME) securityContext: privileged: true # (lots of stuff omitted here...) But now it is possible to use