Managing Security Context

1. Setting runAsUser

securityContext:
  runAsUser: 1000

Scope	Field
Pod-level	`spec.securityContext`
Container-level	`spec.containers[].securityContext` (overrides pod)

securityContext:
  runAsGroup: 3000
  supplementalGroups: [4000, 5000]

Field	Detail
fsGroup	chown mounted volumes recursively
fsGroupChangePolicy	OnRootMismatch (avoids slow recursion)

securityContext:
  runAsNonRoot: true
  runAsUser: 10001

Note: With runAsNonRoot: true, kubelet rejects images whose USER is 0 at start.

securityContext: { readOnlyRootFilesystem: true }
volumeMounts:
- { name: tmp, mountPath: /tmp }
volumes:
- { name: tmp, emptyDir: {} }

securityContext:
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]

Note: Required by Restricted Pod Security Standard.

Warning: privileged: true grants all capabilities + host device access — equivalent to root on host. Avoid except for CNI/CSI agents.

securityContext:
  seLinuxOptions:
    level: "s0:c123,c456"

securityContext:
  seccompProfile:
    type: RuntimeDefault     # or Localhost / Unconfined

type	Behavior
RuntimeDefault	Container runtime default profile
Localhost	Custom profile at `localhostProfile` path
Unconfined	No filtering (avoid)

securityContext:
  appArmorProfile:
    type: RuntimeDefault       # 1.30+ stable; replaces deprecated annotation