Features not usually noticed in Kubernetes

1. Share process namespace between containers in Pod

kubernetes official website link
Process namespace sharing is enabled using the ShareProcessNamespace field in v1.PodSpec. E.g:

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  shareProcessNamespace: true
  containers:
  - name: nginx
    image: nginx
  - name: shell
    image: busybox
    securityContext:
      capabilities:
        add:
        - SYS_PTRACE
    stdin: true
    tty: true

• The container process no longer has it PID 1. In no PID 1case where the number of rejected containers start image (e.g., using systemd container), or refuse to execute kill -HUP 1the command or the like to notify the process vessel. In the process of having a shared namespace pod, the kill -HUP 1will notify the podsandbox (in the example above /pause).
• Process to podbe seen in other containers. This includes /procall visible information, such as password passed as a parameter or environment variables. These routine by Unixprotection rights.
• Container file system /proc/$pid/rootlinks podvisible to other containers. This makes debugging easier, but it also means that file system security is only protected by file system permissions.