Bryan Boreham
8eeb3ca4f2
This allows the main container to run without write access to the host filesystem, except for two specific areas, thus trimming the attack surface. We lose the behaviour that the CNI plugin is only installed if Weave Net gets up and running at least once, so the error reports from kubelet will be slightly different in the case that it never manages to run.