node-shell | Atom Shell bindings for nodeJS | Runtime Evironment library

There are several ways to achieve this and I'd like to start with the first, official one: Pod Security Policy.

The policy you want to implement is the following: Privileged

determines if any container in a pod can enable privileged mode. By default a container is not allowed to access any devices on the host, but a "privileged" container is given access to all devices on the host. This allows the container nearly all the same access as processes running on the host. This is useful for containers that want to use linux capabilities like manipulating the network stack and accessing devices.

The Kubernetes documentation provides few examples on how to interact with PSP, although a big disclaimer must be stated: the PodSecurityPolicy admission controlled must be activated on the API Server.

Besides the official admission controller, there are other projects that allow performing the denial of containers matching criteria, as well as running as privileged: Gatekeeper, Kyverno.

There are other projects that can address your use-case but wanted to share these last two since they seem the most promising ones.

• Gatekeeper
• Kyverno