Superpowered bootstrap containers.

[rajivr]

I was debugging an issue when I realized that is it not possible to have super-powered bootstrap containers in Bottlerocket.

host-ctr does not seem to allow it.

I was wondering why this decision was taken?

[sueun-dev]

There's an open feature request for exactly this, #4731 (labelled status/needs-proposal and status/icebox), and the reasoning is discussed there. The check itself was added while reviewing the original bootstrap containers PR, #1387 (2021), where the author said bootstrap containers can't get the superpowered treatment "just yet".

In #4731, bcressey's concern is that changes a bootstrap container makes to /etc can be clobbered by later settings API changes, and host containers are at least in a position to detect and fix that while bootstrap containers are not. arnaldo2792 adds that they would rather expose missing service settings through the API. For reference, in core-kit v17.2.0 withBootstrap gives bootstrap containers the rootfs and storage mounts, the host PID namespace and all devices, but adds only CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_SYS_CHROOT, CAP_SYS_MODULE and CAP_AUDIT_CONTROL to the default capability set, under the default seccomp profile.

If you need more than that, the #4731 reporter describes their workaround as a superpowered host container that disables itself once its setup is done, and notes that this route can't stop the boot on error.