tree 7e3b9fe5c161cedf1073a086d0b6e5511b20bd98
parent 231ee041b652ab2aea6a64e0c4929fa4beb5851b
author Jan Schär <jan@monogon.tech> 1732795735 +0100
committer Jan Schär <jan@monogon.tech> 1732805157 +0000

m/node/kubernetes: mount PVs with noexec on the host

Now that runc always replaces per-mount-point flags when bind-mounting
volumes inside the container, we can mount them with noexec on the host
without affecting workloads. This has some security advantages, as any
executables in volumes are no longer executable from the host.

Change-Id: Id5a8ea8caf702fca58d300fc9e17c21e94ebaf13
Reviewed-on: https://review.monogon.dev/c/monogon/+/3660
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
Tested-by: Jenkins CI