Function Runtime Permissions and Mounts#

kpt enforces hermetic execution for container-based KRM functions by default — no network access, no host filesystem access. Privileged capabilities (network, mounts, exec binaries) require explicit opt-in, and the available options differ between kpt fn render and kpt fn eval.

Key Types and Files#

Permission Model#

RunnerOptions (render-level flags)#

RunnerOptions centralizes flags that both commands share:

• AllowExec — permits binary executables in the pipeline (render only; eval always uses --exec).
• AllowNetwork — allows container functions to access the network (off by default).
• AllowWasm — alpha; enables Wasm function runtime.
• ImagePullPolicy — controls whether to pull images (always | ifNotPresent | never); defaults to IfNotPresent 1.

ContainerFnPermission (container-level gates)#

ContainerFnPermission has two boolean fields applied when building the docker run (or podman/nerdctl) command:

• AllowNetwork — maps to --network none (default) or --network host 2.
• AllowMount — gates whether StorageMounts are appended to the run args 3.

--security-opt=no-new-privileges is always passed 4, and the container user defaults to nobody unless UIDGID is set 5.

fn render vs fn eval: Permission Differences#

fn render#

fn render is the declarative path. It executes functions declared in the Kptfile pipeline and is intentionally more restricted 6.

• --allow-network sets RunnerOptions.AllowNetwork → forwarded to ContainerFnPermission.AllowNetwork 7.
• No --mount flag exists. AllowMount is hardcoded to false in NewRunner with a comment that it may change in the future 8.
• --allow-exec is required to run binary functions; omitting it blocks exec-based pipeline steps 9.
• No --as-current-user; containers always run as nobody during render.

fn eval#

fn eval is the imperative path. Since the user explicitly specifies the function, it permits more privileged access 10.

• --network → sets Network: true on RunFns, forwarded to ContainerFnPermission.AllowNetwork 11 12.
• --mount → parses mount strings via toStorageMounts() into []runtimeutil.StorageMount, then sets StorageMounts on ContainerFn; AllowMount is hardcoded to true for eval 13.
• --as-current-user → resolves uid:gid via getUIDGID() and sets UIDGID on ContainerFn, allowing the container to access host paths owned by the running user 14.
• --env / -e → passes environment variables into the container; unavailable for exec-based functions 15.
• --mount, --as-current-user, --network, and --env are container-only — using them with --exec returns an error 16.

Capability Matrix#

Mount Format#

--mount accepts Docker volume syntax 17:

--mount type=bind,src="/path/to/dir",dst=/mount-point

All volumes are read-only by default. Pass rw=true to mount read-write:

--mount type=bind,src="/path/to/dir",dst=/mount-point,rw=true

Because container functions default to running as nobody, host paths may be inaccessible without --as-current-user.

Container Runtime Selection#

The runtime binary (docker, podman, or nerdctl) is selected via the KRM_FN_RUNTIME environment variable. When unset, docker is used 18. Minimum supported Docker version is v20.10.0 19.