Kubernetes v1.37 Storage Hardening: Finally Closing the emptyDir Gap

For years, the "readOnlyRootFilesystem: true" checkbox in Kubernetes was a bit of a lie. You'd lock the root, but then you'd mount an emptyDir for scratch space, and suddenly your compromised container has a writable, executable area to download and run a binary. K8s v1.37 finally addresses this with bindMountOptions and emptyDir permission modes.

The Technicals

We now have two primary levers:

• bindMountOptions: Allows specifying noexec, nosuid, and nodev. This is the "big win." Setting noexec on your /tmp mount means the kernel refuses to execute anything from that volume, regardless of the chmod +x status.
• emptyDir mode: You can now set the creation mode (e.g., 01777 for the sticky bit). This prevents a compromised sidecar from deleting the primary application's scratch files in a shared volume.

The Catch: Runtime Dependency

This isn't a simple API toggle. bindMountOptions requires the container runtime to support the CRI mount_options field. If your nodes are running an outdated version of containerd or CRI-O that doesn't advertise this feature, your Pods won't just "fail gracefully"—the Kubelet will reject the Pod entirely.

Furthermore, this only works on Linux. If you're running Windows nodes, these fields are silently ignored. If your security compliance relies on these flags, you're back to square one on Windows.

Verdict

Essential for anyone running high-security workloads. Stop letting your emptyDir be a playground for attackers. Just check your runtime version before you roll this out to production, or you'll be debugging a "Pod rejected" storm.