diff --git a/src/app/backend/deploy.go b/src/app/backend/deploy.go
index 7c4434768cab24c900160455f7c8dd5614c50850..8a9d3d37e5303d2d1a66fcd01a55adc87bd06289 100644
--- a/src/app/backend/deploy.go
+++ b/src/app/backend/deploy.go
@@ -57,6 +57,9 @@ type AppDeploymentSpec struct {
// Labels that will be defined on Pods/RCs/Services
Labels []Label `json:"labels"`
+
+ // Whether to run the container as privileged user (essentially equivalent to root on the host).
+ RunAsPrivileged bool `json:"runAsPrivileged"`
}
// Port mapping for an application deployment.
@@ -99,6 +102,9 @@ func DeployApp(spec *AppDeploymentSpec, client client.Interface) error {
containerSpec := api.Container{
Name: spec.Name,
Image: spec.ContainerImage,
+ SecurityContext: &api.SecurityContext{
+ Privileged: &spec.RunAsPrivileged,
+ },
}
if spec.ContainerCommand != nil {
diff --git a/src/app/externs/backendapi.js b/src/app/externs/backendapi.js
index 2494a78db04e2cffcce1b0da5617ecbb54d0a1c0..fcda7f486b36c10b9c5a4c4449a92e307c28ea72 100644
--- a/src/app/externs/backendapi.js
+++ b/src/app/externs/backendapi.js
@@ -52,7 +52,8 @@ backendApi.Label;
* portMappings: !Array,
* labels: !Array,
* replicas: number,
- * namespace: string
+ * namespace: string,
+ * runAsPrivileged: boolean,
* }}
*/
backendApi.AppDeploymentSpec;
diff --git a/src/app/frontend/deploy/deployfromsettings.html b/src/app/frontend/deploy/deployfromsettings.html
index 9f6199c1a855ba495342ba4678f4eef4d25c7201..3d5ed7429a0471b3d6a18cb74ab567de476be771 100644
--- a/src/app/frontend/deploy/deployfromsettings.html
+++ b/src/app/frontend/deploy/deployfromsettings.html
@@ -129,11 +129,20 @@ limitations under the License.
- By default, your containers run the selected image's default entrypoint command. You can use the
- command options to override the default.
+ By default, your containers run the selected image's default entrypoint command. You can
+ use the command options to override the default.
Learn more
+
+
+
+ Run as privileged
+
+
+ Processes in privileged containers are equivalent to be running as root on the host.
+
+