Set Bind Mount Options on Volume Mounts

Set Bind Mount Options on Volume Mounts

FEATURE STATE: Kubernetes v1.37 [alpha](disabled by default)

This page shows how to apply security-related bind mount options (noexec, nodev, nosuid) to volume mounts in a Pod.

Before you begin

You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:

Your Kubernetes server must be version v1.37.

To check the version, enter kubectl version.

You need to have the VolumeBindMountOptions feature gate enabled on the API server and the kubelet. The container runtime must also support the mount_options field in the CRI Mount message.

Create a Pod with bind mount options

The .spec.containers[*].volumeMounts[*].bindMountOptions field accepts a list of bind mount flags. The allowed values are noexec, nodev, and nosuid.

For example, to mount an emptyDir volume at /tmp with noexec and nosuid so that binaries cannot be executed and set-user-ID bits are ignored:

pods/bind-mount-options.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: bind-mount-options-demo
spec:
  containers:
  - image: registry.k8s.io/busybox
    name: test-container
    command: ["sleep", "3600"]
    volumeMounts:
    - mountPath: /tmp
      name: tmp-volume
      bindMountOptions:
      - noexec
      - nosuid
  volumes:
  - name: tmp-volume
    emptyDir: {}

  1. Create the pod on your cluster:

    kubectl apply -f https://k8s.io/examples/pods/bind-mount-options.yaml

  2. Verify the pod is running:

    kubectl get pod bind-mount-options-demo

  3. Check the mount options on the volume:

    kubectl exec bind-mount-options-demo -- mount | grep /tmp

    The output should include noexec and nosuid in the mount options.

  4. Verify that executing a binary on the mount fails:

    kubectl exec bind-mount-options-demo -- sh -c 'cp /bin/ls /tmp/ls && /tmp/ls'

    The output is similar to:

    sh: /tmp/ls: Permission denied

  5. Delete the Pod that you created for this exercise:

    kubectl delete pod bind-mount-options-demo

What's next

Last modified June 30, 2026 at 2:59 PM PST: Add documentation for KEP-5855: bind mount options on volumeMounts (af9fb1e2de)