readOnlyRootFilesystem

  containerSecurityContext:
   enabled: true
   runAsUser: 11111
   runAsGroup: 11111
   allowPrivilegeEscalation: false
   capabilities:
     drop:
       - all
   readOnlyRootFilesystem: false
   runAsNonRoot: true

Related

• allowPrivilegeEscalation
• Configure a Security Context for a Pod or Container
• Mount emptyDir to /tmp
• --read-only in Docker
• read_only: true # in docker-compose.yaml

See also

• readOnlyRootFilesystem, emptyDir, read_only, --read-only
• securityContext, containerSecurityContext, spec.containers.securityContext, spec.securityContext, spec.securityContext.runAsUser, spec.securityContext.fsGroup, readOnlyRootFilesystem
• Kubernetes security, OPA, EKS security, PSA, PSS, CKS, SecurityContext, containerSecurityContext, Trivy, KubeBench, Kubernetes Admission Controllers admissionregistration.k8s.io, Hardeneks, Gatekeeper (Kubernetes), kubernetes.io/enforce-mountable-secrets, Auditing, security context, readOnlyRootFilesystem, allowPrivilegeEscalation, kube-bench