KEP-5474: Introduce WritableCgroups option

[Divya063]

• One-line PR description: KEP - Add support for writable cgroups field under container.SecurityContext

• Issue link: Enable Writable cgroups for unprivileged containers #5474

• Other comments:

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Divya063
Once this PR has been reviewed and has the lgtm label, please assign derekwaynecarr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• keps/sig-node/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Welcome @Divya063!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @Divya063. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[chrishenzie]

Hi! Thank you for the work on this KEP. I'm requesting changes before this can be approved, primarily to address a security and resource isolation concern.

I strongly support the proposed direction of adding a field to the Pod SecurityContext and CRI API. This is the right approach for providing fine-grained control and is much more secure than relying on a broad, runtime-level configuration.

My primary concern, which I believe is a blocker for approval, is the risk of intra-pod resource starvation. Please see my comments under "Risks and Mitigations" for details.

I also left a couple of comments with suggestions to improve clarify, primarily around removing any potentially confusing references to the Runtime config field to make it unambiguous that the CRI-based API field is the sole proposed approach.

I'm happy to discuss these points further. Thank you!

[chrishenzie]

/assign @chrishenzie

[Divya063]

Thank you @chrishenzie for providing the initial feedback! I'm changing the PR to draft state while I work on the doc. Once it's ready, I'll let you know.

[chrishenzie]

Thanks for the update and taking my feedback into consideration. I look forward to the next version of the document.

As you might have gathered from my review, this is a feature I'm interested in and have spent a good deal of time researching independently. It seems we're aligned on the importance of this capability for the community and the need to get the API and security model right.

Given our mutual interest, I wanted to offer to partner with you on this KEP if you'd be open to it. I'd be happy to contribute my research and help however I can to move this forward.

If you're interested, please feel free to DM me on the Kubernetes Slack (@chrishenzie) or reach out via email so we can connect.

Regardless, I appreciate you driving this important work. Let me know if there is any way I can help.

[Divya063]

Thanks @chrishenzie for offering to partner on this KEP! I will be happy to collaborate. I have addressed your comments and would like to discuss a few things.

• For this feature, would it be okay if we have the baseline profile of Pod security standards?
• I have moved the alpha milestone to K8s 1.35. I think that once we finalize the design, we can make the necessary changes in both CRI and containerd before the containerd Release (Nov 2025).

Let me know what you think.

[chrishenzie]

Hi @Divya063,

Thanks again for the excellent work on this KEP and for your collaboration. I've left some detailed comments, but my main feedback is summarized here.

To help coordinate the implementation work, I have opened a tracking issue in the containerd/containerd repository. This follows the new SIG-Node collaboration process and will be the best place to discuss the runtime-specific details:

• containerd Tracking Issue: containerd/containerd#12252

My primary feedback is that the KEP would be stronger if it remained focused on the CRI API as a runtime-agnostic contract, rather than referencing specific runtimes. This approach ensures the feature is applicable to the entire ecosystem (including CRI-O) and aligns with the SIG-Node policy requiring multiple implementations for graduation.

I believe the proposed changes, especially the validation requiring the Guaranteed QoS class, effectively address the key security and resource isolation concerns.

I'm looking forward to collaborating with you to move this forward.

[chrishenzie]

Can you expand on this? What would it mean to be enforced? Is this new behavior or leveraging existing kubelet behavior? Any links to relevant files are appreciated

[Divya063]

I have changed this section, on unsupported runtimes Kubelet will now return an error.

[AkihiroSuda]

RuntimeHandlerFeatures should be updated too

https://github.com/kubernetes/cri-api/blob/v0.34.0/pkg/apis/runtime/v1/api.proto#L1708

[Divya063]

Thanks @AkihiroSuda! I didn't know about this field.

[AkihiroSuda]

Why not return an error on cgroup v1 ?

[Divya063]

Updated the KEP, we will do a validation and return an error.

[Divya063]

Thanks @chrishenzie and @AkihiroSuda! I have addressed the comments and have removed specific runtime references. The PR is ready for another round of review.