containerd.socket mounting inside container - security concern / best practice deviation? about akri HOT 5 OPEN

The containerd socket is mounted inside the agent's container to allow for slot reconciliation, the need for this socket is specified in the documentation as well : https://docs.akri.sh/user-guide/cluster-setup#configure-crictl

In a nutshell, as the DevicePlugin system doesn't call the agent when de-allocating the resource, we have to get the information about really used resources from the CRI endpoint.

There are future developments that will close this gap, namely the DRA (Dynamic Resource Allocation) mode that is currently planned will replace the DevicePlugin system with DRA that do notify the driver on de-allocation of resources.

Please note that DRA will not be on by default until it is out of alpha stage on all supported kubernetes versions.

from akri.

This may point out that Akri cannot achieve 1.0 until it has moved to DRA due to this security concern.

from akri.

@diconico07 is investigating a new approach in #684 which does not mount the containerd.socket

from akri.

Issue has been automatically marked as stale due to inactivity for 90 days. Update the issue to remove label, otherwise it will be automatically closed.

from akri.

Not stale, still an issue.

from akri.