KEP-5474keps/sig-node/5474-enable-writable-cgroups
Enable Writable Cgroups
This KEP proposes adding a CgroupOptions struct field to the container SecurityContext in Kubernetes to allow unprivileged containers to have writable access to cgroup interfaces on cgroup v2 systems. This feature relies on the kernel's nsdelegate mount option to ensure containers can only manage their own cgroup subtrees, preventing unauthorized access to s… Full summary
This KEP proposes adding a CgroupOptions struct field to the container SecurityContext in Kubernetes to allow unprivileged containers to have writable access to cgroup interfaces on cgroup v2 systems. This feature relies on the kernel's nsdelegate mount option to ensure containers can only manage their own cgroup subtrees, preventing unauthorized access to system resources. The explicit API field is required to provide visibility, policy enforcement, and defense-in-depth for this capability.
Facts
- Authors
- @chrishenzie@divya063
- Approvers
- @dchen1107
- Reviewers
- none
- PRR approvers
- @kannon92alpha
- Tracking issue
- #5474(opens GitHub in a new tab) openmilestone v1.38sig/authsig/nodestage/alphatracked/yeslead-opted-in
- Milestones
- alpha v1.38beta v1.39
- Participating SIGs
- sig-auth
- Feature gates
- CgroupOptions
- Created / last updated
- 2025-08-25 / none
Loading decisions and status history