Pin flaresolverr runAsUser/runAsGroup to 1000
The image declares its non-root user by name only, which the kubelet's runAsNonRoot check cannot verify (CreateContainerConfigError); pinning the uid/gid numerically satisfies the check.
This commit is contained in:
1 file changed
+5
-1
@@ -300,11 +300,15 @@ flaresolverr:
|
|||||||
memory: 512Mi
|
memory: 512Mi
|
||||||
ephemeralStorage: 200Mi
|
ephemeralStorage: 200Mi
|
||||||
# The image runs as its own non-root user; chromium's writable paths (/tmp,
|
# The image runs as its own non-root user; chromium's writable paths (/tmp,
|
||||||
# /dev/shm) are emptyDirs, so the full hardening baseline holds.
|
# /dev/shm) are emptyDirs, so the full hardening baseline holds. runAsUser/
|
||||||
|
# runAsGroup pin the image's "flaresolverr" user numerically (uid/gid 1000,
|
||||||
|
# the image declares it by name only, which runAsNonRoot cannot verify).
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
readOnlyRootFilesystem: true
|
readOnlyRootFilesystem: true
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
capabilities:
|
capabilities:
|
||||||
drop:
|
drop:
|
||||||
- ALL
|
- ALL
|
||||||
|
|||||||
Reference in new issue
Block a user