Difference between revisions of "ReadOnlyRootFilesystem"
Jump to navigation
Jump to search
Tags: Mobile web edit, Mobile edit |
Tags: Mobile web edit, Mobile edit |
||
| Line 7: | Line 7: | ||
* Mount <code>[[emptyDir]]</code> to <code>[[/tmp]]</code> | * Mount <code>[[emptyDir]]</code> to <code>[[/tmp]]</code> | ||
* [[--read-only]] in [[Docker]] | * [[--read-only]] in [[Docker]] | ||
| + | * [[read_only]]: true # in [[docker-compose.yaml]] | ||
== See also == | == See also == | ||
Revision as of 16:40, 1 June 2026
containerSecurityContext: enabled: true runAsUser: 11111 runAsGroup: 11111 allowPrivilegeEscalation: false capabilities: drop: - all readOnlyRootFilesystem: false runAsNonRoot: true
Related
allowPrivilegeEscalation- Configure a Security Context for a Pod or Container
- Mount
emptyDirto/tmp - --read-only in Docker
- read_only: true # in docker-compose.yaml
See also
readOnlyRootFilesystem, emptyDir,read_only, --read-onlysecurityContext, containerSecurityContext, spec.containers.securityContext, spec.securityContext, spec.securityContext.runAsUser, spec.securityContext.fsGroup,readOnlyRootFilesystem- Kubernetes security, OPA, EKS security, PSA, PSS, CKS,
SecurityContext, containerSecurityContext, Trivy, KubeBench, Kubernetes Admission Controllersadmissionregistration.k8s.io, Hardeneks, Gatekeeper (Kubernetes),kubernetes.io/enforce-mountable-secrets, Auditing, security context,readOnlyRootFilesystem,allowPrivilegeEscalation,kube-bench
Advertising:
