run kubernetes deployment as non root

Signed-off-by: Chmouel Boudjnah <[email protected]>
chmouel · Sep 11, 2024 · aba2057 · aba2057
1 parent c5f9cab
commit aba2057
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -10,5 +10,5 @@ RUN microdnf -y update && microdnf -y --nodocs install tar rsync shadow-utils &&
 COPY --from=0 /tmp/gosmee /usr/local/bin/gosmee
 
 WORKDIR /home/gosmee
-USER gosmee
+USER 1001
 ENTRYPOINT ["/usr/local/bin/gosmee"]
diff --git a/misc/kubernetes-deployment.yaml b/misc/kubernetes-deployment.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -27,3 +26,11 @@ spec:
               "https://yousmee.url",
               "http://deployment.name.namespace.name:PORT_OF_SERVICE",
             ]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - "ALL"
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault