ADR-019 Volumes are attached after the pivot

A volume is a host path the kubelet asks to see at a path inside the container: the service account token, /etc/hosts, the termination log, every hostPath and emptyDir. The target lies in the image, and the image is not trusted. Resolve /etc/hosts in a root filesystem whose /etc is a symlink to / and the mount lands on the host's own; runc has had this class of hole more than once (CVE-2021-30465, CVE-2024-21626).

Here the child clones each source as a detached mount with open_tree while it still sees the host, pivots, and only then creates the target and its parents and attaches the mount with move_mount. After the pivot an absolute symlink can only lead somewhere inside the container. A test puts exactly such a symlink in an image and mounts through it; done the naive way, before the pivot, it creates a directory on the host and the test fails.

The cost: Linux 5.2 or newer, for the two calls. Every kernel a current Kubernetes supports has them.