Skip to content

[docker-pmon] limit privileged flag for pmon container #23457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qiluo-msft merged 9 commits into from
Sep 9, 2025
Merged

[docker-pmon] limit privileged flag for pmon container #23457

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e4a26a6
Test with most permissions remove
DavidZagury Jul 2, 2025
12239a2
Remove apparmor and systempaths restrictions
DavidZagury Jul 6, 2025
4afc1d5
Fix missing dev/sda and sys/module
DavidZagury Jul 7, 2025
36add0d
Add watchdogs
DavidZagury Jul 9, 2025
b2983ed
Fix docker_image_ctl
DavidZagury Jul 13, 2025
ce85c25
No need for SYS_MODULE
DavidZagury Jul 13, 2025
8d4c248
Move mlx paths to only be on mlx
DavidZagury Jul 13, 2025
4a69672
Remove comment
DavidZagury Jul 13, 2025
acd72c6
Remove sda
DavidZagury Jul 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions files/build_templates/docker_image_ctl.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -684,6 +684,8 @@ start() {
-v /var/log/sai_failure_dump:/var/log/sai_failure_dump:rw \
-e SX_API_SOCKET_FILE=/var/run/sx_sdk/sx_api.sock \
{%- elif docker_container_name == "pmon" %}
-v /sys/devices/platform/mlxplat:/sys/devices/platform/mlxplat:rw \
Copy link
Contributor

@ds952811 ds952811 Aug 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like something nVidia/MLX platform specific, while this is a templates for all vendors. I'm afraid this is not the right thing to do, can we move this to a vendor specific template?

Copy link
Collaborator

@qiluo-msft qiluo-msft Aug 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is already inside sonic_asic_platform == "mellanox" branch. The ask is to verify the critical change of removing --privileged also works for broadcom platform @ds952811 Could you help verify?

The purpose is to reduce the privileged container usage and improve the security.

Copy link
Contributor

@ds952811 ds952811 Aug 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy that, thanks for the clarification

-v /sys/module/sx_core:/sys/module/sx_core:rw \
Copy link
Collaborator

@qiluo-msft qiluo-msft Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This path may not exist on Mellanox platform.

admin@sonic:~$ docker restart pmon
Error response from daemon: Cannot restart container pmon: error while creating mount source path '/sys/module/sx_core': mkdir /sys/module/sx_core: operation not permitted

-v /var/run/hw-management:/var/run/hw-management:rw \
-v mlnx_sdk_socket:/var/run/sx_sdk \
-v /tmp/nv-syncd-shared/:/tmp \
Expand All @@ -705,6 +707,8 @@ start() {
{%- endif %}
{%- if docker_container_name == "pmon" %}
-v /usr/share/sonic/firmware:/usr/share/sonic/firmware:rw \
$(if [ -e "/dev/watchdog" ]; then echo "--device=/dev/watchdog:/dev/watchdog"; fi) \
$(for watchdog in /sys/class/watchdog/*; do if [ -d "$watchdog" ]; then device_name=$(basename "$watchdog"); dev_file="/dev/$device_name"; if [ -e "$dev_file" ]; then echo "--device=$dev_file:$dev_file"; fi; fi; done) \
{%- endif %}
{%- if docker_container_name == "swss" %}
-e ASIC_VENDOR={{ sonic_asic_platform }} \
Expand Down
4 changes: 3 additions & 1 deletion rules/docker-platform-monitor.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,13 +50,15 @@ SONIC_DOCKER_DBG_IMAGES += $(DOCKER_PLATFORM_MONITOR_DBG)
SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_PLATFORM_MONITOR_DBG)

$(DOCKER_PLATFORM_MONITOR)_CONTAINER_NAME = pmon
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += --privileged -t
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += --cap-add=SYS_RAWIO --cap-add=SYS_ADMIN -t --security-opt apparmor=unconfined --security-opt="systempaths=unconfined"
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /etc/sonic:/etc/sonic:ro
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /etc/localtime:/etc/localtime:ro
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /host/reboot-cause:/host/reboot-cause:rw
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /host/pmon/stormond:/usr/share/stormond:rw
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /var/run/platform_cache:/var/run/platform_cache:ro
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /usr/share/sonic/device/pddf:/usr/share/sonic/device/pddf:ro
# Add LED device mounts for hardware access
$(DOCKER_PLATFORM_MONITOR)_RUN_OPT += -v /sys/class/leds:/sys/class/leds:rw

# Mount Arista python library on Aboot images to be used by plugins
$(DOCKER_PLATFORM_MONITOR)_aboot_RUN_OPT += -v /usr/lib/libsfp-eeprom.so:/usr/lib/libsfp-eeprom.so:ro
Expand Down
Loading