Skip to content

Commit 51643bb

Browse files
authored
More clarifications
1 parent 1e68707 commit 51643bb

File tree

1 file changed

+12
-6
lines changed

1 file changed

+12
-6
lines changed

docs/vmdriver-none.md

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ The `none` driver allows advanced minikube users to skip VM creation, allowing m
88

99
## What operating systems are supported?
1010

11-
The `none` driver supports releases of Debian, Ubuntu, and Fedora that are less than 2 years old
12-
13-
In practice, any systemd-based modern distribution is likely to work, and we will happily accept pull requests which improve compatibility with other systems.
11+
The `none` driver supports releases of Debian, Ubuntu, and Fedora that are less than 2 years old. In practice, any systemd-based modern distribution is likely to work, and we will accept pull requests which improve compatibility with other systems.
1412

1513
## Can vm-driver=none be used outside of a VM?
1614

@@ -22,11 +20,19 @@ minikube was designed to run Kubernetes within a dedicated VM, and assumes that
2220
* /usr/local/bin/kubectl
2321
* /etc/kubernetes
2422

25-
## Security
23+
It will also install `kubelet` as a systemd service, as well as start/stop container runtime services if installed.
24+
25+
## Security Limitations
26+
27+
With the `none` driver, minikube has limited container isolation abilities. Applications running in a container may be able to access your host filesystem. Through using a container escape vulnerability such as [CVE-2019-5736](https://access.redhat.com/security/vulnerabilities/runcescape), they may also be able to execute arbitrary code on your host.
28+
29+
When using the `none` driver, it is highly recommended that your host is isolated from the rest of the network using a firewall.
30+
31+
Additionally, minikube with the `none` driver has a very confusing permissions model, as some commands need to be run as root ("start"), and others by a regular user ("dashboard"). In a future release, we intend to disallow running `minikube`, and instead call into `sudo` when necesarry to avoid permissions issues.
2632

27-
With the `none` driver, minikube has only limited container isolation abilities, which can result in decreased host security and reliability. It is highly recommended that your host is isolated from the rest of the network using a firewall.
33+
# Uninstall
2834

29-
Additionally, minikube with the `none` driver has a very confusing permissions model, as some commands need to be run as root ("start"), and others by a regular user ("dashboard").
35+
The `none` driver now supports uninstallation via `minikube delete`. Please note that it will not fully remove /etc/kubernetes, since it does not track which files in /etc/kubernetes existed before the installation.
3036

3137
## Known Issues
3238

0 commit comments

Comments
 (0)