# Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions

DevFeed: [Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions](<https://devfeed.tech/articles/kubernetes-v1-37-hardening-container-storage-with-bind-mount-options-and-emptydir-permissions-31483.md>)

Original publisher: [Read original article](<https://kubernetes.io/blog/2026/09/16/kubernetes-v1-37-hardening-container-storage/>)

Author: Nispriha Jagan; Neeraj Krishna Gopalakrishna

Published: 2026-09-16T18:30:00Z

Content type: article

Language: en

Sources: [Kubernetes Blog](<https://devfeed.tech/sources/kubernetes-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Security](<https://devfeed.tech/topics/security.md>), [mount](<https://devfeed.tech/topics/mount.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [chmod](<https://devfeed.tech/topics/chmod.md>), [Unix](<https://devfeed.tech/topics/unix.md>)

Tags: [chmod](<https://devfeed.tech/tags/chmod.md>), [container](<https://devfeed.tech/tags/container.md>), [containers](<https://devfeed.tech/tags/containers.md>), [filesystem](<https://devfeed.tech/tags/filesystem.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mount](<https://devfeed.tech/tags/mount.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [storage](<https://devfeed.tech/tags/storage.md>), [volume](<https://devfeed.tech/tags/volume.md>), [volumes](<https://devfeed.tech/tags/volumes.md>)

## AI overview

Kubernetes v1.37 adds bind mount options and emptyDir permission modes to strengthen storage security. The article explains how noexec, nosuid, nodev, Unix permissions, and the sticky bit can help enforce security policies on writable volumes.

## Source excerpt

Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mounts or remounts a directory, Virtual File System (VFS) flags control what actions are permitted on that filesystem: noexec: Do not permit direct execution of any binaries on the mounted filesystem. nosuid: Do not allow set-user-identifier or set-group-identifier bits to take effect. nodev: Do not interpret character or block special devices on the file system. Directory permissions and the sticky bit Standard Unix permissions regulate access across three scopes: Owner, Group, and Others (e.g., 0755 or 0777). Beyond standard read, write, and execute bits, Linux supports the sticky bit (as in mode 01777). When applied to a directory, the sticky bit ensures that a file inside that directory can only be deleted or renamed by the file's owner or root. This is essential for shared writable directories like /tmp. Motivation for the improvements Why does Kubernetes need bind mount options and emptyDir permissions? The primary goal of these features is to increase the security of Kubernetes workloads by allowing security-related bind mount options on volume mounts. By default, volumes are bind-mounted into containers by the container runtime and kubelet without noexec, nosuid, or nodev flags. This default can undermine security. For example, with noexec missing, a compromised process can use any writable volume (emptyDir, PersistentVolume, etc.) to download, chmod +x, and execute arbitra