diff --git a/ansible/roles/horizon/defaults/main.yml b/ansible/roles/horizon/defaults/main.yml index f8aaa408bc..1ed0373524 100644 --- a/ansible/roles/horizon/defaults/main.yml +++ b/ansible/roles/horizon/defaults/main.yml @@ -127,7 +127,6 @@ horizon_default_volumes: - "/etc/localtime:/etc/localtime:ro" - "{{ '/etc/timezone:/etc/timezone:ro' if ansible_facts.os_family == 'Debian' else '' }}" - "kolla_logs:/var/log/kolla/" - - "/tmp:/tmp" horizon_extra_volumes: "{{ default_extra_volumes }}" diff --git a/releasenotes/notes/harden_horizon_tmp_usage-0d690e49645b99a8.yaml b/releasenotes/notes/harden_horizon_tmp_usage-0d690e49645b99a8.yaml new file mode 100644 index 0000000000..323ccd53be --- /dev/null +++ b/releasenotes/notes/harden_horizon_tmp_usage-0d690e49645b99a8.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Removes the default `/tmp/` mountpoint from the horizon container. This + change is made to harden the container and prevent potential security + issues. For more information, see the Bug Report: `LP#2068126 `__.