Hardening Pods with securityContext
Drop a workload's privileges: run as non-root, forbid privilege escalation, make the root filesystem read-only, and drop all Linux capabilities.
Your mission
By default a container runs as root, can escalate privileges, has a writable
filesystem, and carries a batch of Linux capabilities it almost never needs.
Each of those is a lever an attacker who breaks into the container can pull. A
securityContext takes the levers away.
The hardening baseline every reviewer looks for:
runAsNonRoot/runAsUser— don't run as root.allowPrivilegeEscalation: false— a process can't gain more privileges than it started with (no setuid tricks).readOnlyRootFilesystem: true— the container can't write to its own image.capabilities.drop: [ALL]— start from zero kernel capabilities and add back only what's genuinely required.
securityContext lives in two places: at the Pod level (applies to all containers) and at the container level (overrides per-container). In this lab you take a container from default-permissive to locked-down.
Useful aliases
k is aliased to kubectl and completion is configured. The jumpbox also has
k9s, jq and yq.