News › security
By Zayden R., September 18, 2026
Kubernetes v1.37 introduces bind mount options and emptyDir permissions, significantly bolstering container storage security. Engineers can now enforce stricter security policies directly in Kubernetes, mitigating risks like arbitrary binary execution.
Kubernetes has rolled out version 1.37, a release that brings notable advancements in container storage security with the introduction of bind mount options and emptyDir permissions. These updates are crucial for engineers focused on enhancing the security of their Kubernetes workloads, as they offer a more straightforward method to enforce rigorous security policies.
In the realm of Linux systems, bind mount options like noexec, nosuid, and nodev have long been tools for controlling filesystem actions. However, until now, Kubernetes volumes were bind-mounted into containers by the container runtime and kubelet without these security flags. This oversight could lead to vulnerabilities, such as the execution of arbitrary binaries on writable volumes, even when containers are configured with a read-only root filesystem.
The newly supported options aim to fill this security gap. By allowing the application of noexec, nodev, and nosuid flags, Kubernetes users can now align their volume mounts with established security benchmarks and policies. This is a solid improvement, providing a native way to harden workloads against potential exploits.
Furthermore, the introduction of emptyDir permissions, which includes the ability to set permission modes and utilize the sticky bit, enhances security for shared writable directories. The sticky bit, a Unix permission that ensures only file owners or root can delete or rename files, is particularly vital for directories like /tmp, commonly used for shared writable access.
For Kubernetes users, these enhancements mean that implementing stringent security measures no longer requires complex workarounds. Instead, they can be directly configured within Kubernetes, simplifying the process and reducing the potential for human error. As security remains a top priority for containerized applications, these changes in Kubernetes v1.37 are a welcome addition for any engineer looking to bolster their system's defenses.