kubernetes
/
minikube
mirror of https://github.com/kubernetes/minikube.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Make the none driver clearer.

pull/3698/head
Thomas Strömberg 2019-02-15 21:45:49 -08:00 committed by GitHub
parent a1f7befff4
commit 1211eda1c6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
docs/vmdriver-none.md
View File

@ -4,36 +4,31 @@
This document is written for system integrators who are familiar with minikube, and wish to run it within a customized VM environment.
`--vm-driver=none` allows advanced minikube users to skip VM creation, allowing minikube to be run on a user-supplied VM.
The `none` driver allows advanced minikube users to skip VM creation, allowing minikube to be run on a user-supplied VM.
## What operating systems are supported?
`--vm-driver=none` supports releases of Debian, Fedora, and buildroot that are less than 2 years old.
The `none` driver supports releases of Debian, Ubuntu, and Fedora that are less than 2 years old
While the standard minikube guest VM uses buildroot, minikube integration tests are also regularly run against Debian 9 for compatibility. In practice, any systemd-based modern distribution is likely to work, and we will happily accept pull requests which improve compatibility with other systems.
## Should vm-driver=none be used on a personal development machine? No.
No. Please do not do this, ever.
minikube was designed to run Kubernetes within a dedicated VM, and when used with `--vm-driver=none`, may overwrite system binaries, configuration files, and system logs. Executing `minikube --vm-driver=none` outside of a VM could result in data loss, system instability and decreased security.
Usage of `--vm-driver=none` outside of a VM could also result in services being exposed in a way that may make them accessible to the public internet. Even if your host is protected by a firewall, these services still be vulnerable to [CSRF](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)) or [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks.
In practice, any systemd-based modern distribution is likely to work, and we will happily accept pull requests which improve compatibility with other systems.
## Can vm-driver=none be used outside of a VM?
Yes, but only after appropriate security and reliability precautions have been made. `minikube --vm-driver=none` assumes complete control over the environment is is executing within, and may overwrite system binaries, configuration files, and system logs.
Not if you can avoid it.
The host running `minikube --vm-driver=none` should be:
minikube was designed to run Kubernetes within a dedicated VM, and assumes that it has complete control over the machine it is executing on. With the `none` driver, minikube will overwrite the following system paths:
* Isolated from the rest of the network with a firewall
* Disposable and easily reprovisioned, as this mode may overwrite system binaries, configuration files, and system logs
* /usr/local/bin/kubeadm
* /usr/local/bin/kubectl
* /etc/kubernetes
If you find yourself running a web browser on the same host running `--vm-driver=none`, please see __Should vm-driver=none be used on a personal development machine? No.__
## Security
With the `none` driver, minikube has only limited container isolation abilities, which can result in decreased host security and reliability. It is highly recommended that your host is isolated from the rest of the network using a firewall.
Additionally, minikube with the `none` driver has a very confusing permissions model, as some commands need to be run as root ("start"), and others by a regular user ("dashboard").
## Known Issues
* You cannot run more than one `--vm-driver=none` instance on a single host #2781
* `--vm-driver=none` deletes other local docker images #2705
* `--vm-driver=none` fails on distro's which do not use systemd #2704
* Many `minikube` commands are not supported, such as: `dashboard`, `mount`, `ssh`, `stop` #3127
* You cannot run more than one `--vm-driver=none` instance on a single host
* Many `minikube` commands are not supported, such as: `dashboard`, `mount`, `ssh`