Pin flaresolverr runAsUser/runAsGroup to 1000
The image declares its non-root user by name only, which the kubelet's runAsNonRoot check cannot verify (CreateContainerConfigError); pinning the uid/gid numerically satisfies the check.
This commit is contained in:
1 file changed
+5
-1
@@ -300,11 +300,15 @@ flaresolverr:
|
||||
memory: 512Mi
|
||||
ephemeralStorage: 200Mi
|
||||
# The image runs as its own non-root user; chromium's writable paths (/tmp,
|
||||
# /dev/shm) are emptyDirs, so the full hardening baseline holds.
|
||||
# /dev/shm) are emptyDirs, so the full hardening baseline holds. runAsUser/
|
||||
# runAsGroup pin the image's "flaresolverr" user numerically (uid/gid 1000,
|
||||
# the image declares it by name only, which runAsNonRoot cannot verify).
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
Reference in new issue
Block a user