TL;DR

  • Kubernetes v1.37 ships two storage-security features: emptyDir permission modes and bind mount options (announcement).
  • bindMountOptions puts noexec, nosuid and nodev on the bind mount any volume creates inside a container; mode sets how an emptyDir is created instead of the hardcoded 0777.
  • Both are Alpha behind VolumeBindMountOptions and EmptyDirVolumeMode gates on the API server and kubelet.
  • Netics' take: the deepest container security gap was never the image — it was the writable volume; these flags close the path where a compromised process turns scratch space into an executable.
  • Practical move: enable the gates on one node, apply noexec/nosuid to emptyDir and /tmp mounts, and set 01777 on shared workspace volumes.

Reproduction of the official kubernetes.io blog post announcing Kubernetes v1.37 storage hardening features

Reproduction of the official Kubernetes blog post "Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions" (September 16, 2026); source: kubernetes.io/blog

The most common writable volume had the least control

Here is the quiet fact behind the v1.37 release notes: emptyDir — the most common writable volume type in Kubernetes — created its directories with a hardcoded mode of 0777, and volumes were bind-mounted into containers with no noexec flag at all. Any process that could discover the volume could read, write, and delete everything in it, which for a ReadWriteMany-style shared scratch space is an open door between containers. Kubernetes had flags for this at the Linux level for decades: noexec (no direct execution of binaries), nosuid (no setuid/setgid bits), nodev (no device files). It just never gave users a native way to apply them to the mount the container runtime creates.

The security impact is sharper than it looks. A container with readOnlyRootFilesystem: true is hardened everywhere except its writable volumes — and if those volumes lack noexec, a compromised process can download a binary, chmod +x, and execute it from the very scratch space the security model left writable. External auditors flagged exactly this in the Kubernetes 1.24 Security Audit (Finding NCC-E003660-7HM), and the gap had its own long-lived issue (#48912). Both stayed unresolved until v1.37.

Original Netics diagram: what noexec, nosuid and nodev do at the VFS layer, before and after v1.37

Original Netics diagram: the Linux VFS mount flags noexec, nosuid and nodev, and what they block on a container bind mount; source: Kubernetes v1.37 storage hardening post

Two fields, one layer, at the kubelet

KEP-5855 adds a bindMountOptions field on volumeMounts in the pod spec. When set, the kubelet passes the options through the CRI Mount message to the container runtime, which includes them in the OCI runtime spec mount options — the low-level runtime then applies the flags on the bind mount inside the container. Because the field sits on volumeMounts, it works for every volume type (emptyDir, PersistentVolumes, CSI, projected, ConfigMaps, Secrets — image volumes are the only exception) and it gives per-container granularity: two containers in the same pod can mount the same volume with different options.

KEP-5502 adds a mode field on emptyDir. Instead of a hardcoded 0777, you can now declare 01777 for a shared workspace that behaves like /tmp (sticky bit: each container can write, but only the file owner or root can delete), or 0750 to lock a database's scratch volume to its own group. The previous workaround — an init container running chmod — was brittle and hard to verify for compliance; the field makes the permission declarative and auditable.

Reproduction of the official KEP-5855 page on GitHub (kubernetes/enhancements) showing the bind mount options proposal

Reproduction of the official Kubernetes enhancement proposal KEP-5855 (Allow bind mount options on volumeMounts), kubernetes/enhancements on GitHub; source: github.com/kubernetes/enhancements

Where the Alpha bumps and the silent fallback live

Both features arrive as Alpha in v1.37, behind VolumeBindMountOptions and EmptyDirVolumeMode, enabled on the API server and the kubelet. The version-skew behavior deserves attention because the two features fail differently. For emptyDir mode: if the API server has the gate enabled but the kubelet does not, the field is accepted but silently ignored — the kubelet falls back to 0777, the exact behavior you are trying to remove. For bindMountOptions: the scheduler uses Node Declared Features to avoid placing pods on nodes without runtime support, and if a pod reaches such a node anyway, the kubelet rejects it rather than silently ignoring the options. One degrades in silence; the other fails loudly. That asymmetry is the kind of thing you only discover in a staging rollout, and it is the reason the "things to know" list in the announcement deserves a full read.

Original Netics diagram: before and after of emptyDir permissions — hardcoded 0777 versus declared 01777 sticky bit and 0750 group-restricted modes

Original Netics diagram: emptyDir before v1.37 (hardcoded 0777, no mount flags) and after (declared mode, noexec/nosuid/nodev); source: Kubernetes v1.37 storage hardening post

There is one more interaction to plan for: fsGroup. If fsGroup is set in the pod's security context, the group permissions applied by fsGroup override the mode you specify on the emptyDir — the same behavior that already exists for defaultMode on Secret and ConfigMap volumes. And everything here is Linux-only; Windows nodes skip both fields.

The adoption path that actually works

Start where the exposure is densest: emptyDir and /tmp mounts are the volumes every workload touches, and they are the ones attackers reach first with a payload. On one node, enable both gates, mount a scratch volume with bindMountOptions: [noexec, nosuid], and keep readOnlyRootFilesystem: true — that combination removes the download-and-execute path entirely. Second, for multi-container pods sharing a workspace (CI build containers, sidecar loggers), set mode: 01777 so a compromised container can no longer delete another container's build artifacts — the sticky bit does exactly what the shared-/tmp problem has needed for years. Third, for stateful workloads, move deliberately: PersistentVolume and CSI adoption of these flags will take longer because it shifts provisioning defaults, and the silent-0777 fallback on mixed old/new nodes means your admission logic cannot yet trust mode alone as an enforcement signal.

Original Netics diagram: the v1.37 warnings — Alpha gates, silent 0777 fallback on old kubelets, fsGroup override, and Linux-only scope

Original Netics diagram: the operational warnings around v1.37 storage hardening — Alpha gates, silent emptyDir fallback, fsGroup override, Linux-only; source: Kubernetes v1.37 storage hardening post

For teams operating Kubernetes estates, the practical question is whether these controls are enabled, observable, and safe to roll out across mixed-version nodes: ValidatingAdmissionPolicy governs what gets admitted; it cannot govern what a volume does after the pod is running. Mount flags and directory modes live at the layer admission never reaches, which is exactly why they matter more than the next API-server guardrail. For a practical pass over your volume policies, compare these controls against your node versions and rollout plan.

Originally published on the Netics blog.