Commit736495d

authored

run image as non-root user & add securitycontext values (#138)

* run image as non-root user & add securitycontext values* rm redundant comments

1 parenta5bd376 commit736495dCopy full SHA for 736495d

File tree

+16

-3

lines changed

+16

-3

lines changed

Lines changed: 4 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -98,6 +98,10 @@ spec:`
`98`	`98`	`nodeSelector:`
`99`	`99`	`{{- toYaml . \| nindent 8 }}`
`100`	`100`	`{{- end }}`
	`101`	`+{{- with .Values.podSecurityContext }}`
	`102`	`+podSecurityContext:`
	`103`	`+{{- toYaml . \| nindent 8 }}`
	`104`	`+{{- end }}`
`101`	`105`	`containers:`
`102`	`106`	`-name:coder-logstream-kube`
`103`	`107`	`image:"{{ .Values.image.repo }}:{{ .Values.image.tag \| default .Chart.AppVersion }}"`

Lines changed: 10 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -92,12 +92,20 @@ labels: {}`
`92`	`92`
`93`	`93`	`# securityContext -- Container-level security context`
`94`	`94`	`# See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/`
`95`		`-securityContext:{}`
`96`		`-# allowPrivilegeEscalation: false`
	`95`	`+securityContext:`
	`96`	`+runAsNonRoot:true`
	`97`	`+runAsUser:65532`
	`98`	`+runAsGroup:65532`
	`99`	`+allowPrivilegeEscalation:false`
`97`	`100`	`# capabilities:`
`98`	`101`	`# drop:`
`99`	`102`	`# - ALL`
`100`	`103`	`# readOnlyRootFilesystem: true`
`101`	`104`	`# runAsNonRoot: true`
`102`	`105`	`# seccompProfile:`
`103`	`106`	`# type: RuntimeDefault`
	`107`	`+`
	`108`	`+podSecurityContext:{}`
	`109`	`+# Optional, only if your cluster requires group ownership for mounted volumes:`
	`110`	`+# podSecurityContext:`
	`111`	`+# fsGroup: 65532`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`FROM --platform=$BUILDPLATFORM scratch AS base`
`2`	`2`	`ARG TARGETARCH`
`3`		`-COPY ./coder-logstream-kube-${TARGETARCH} /coder-logstream-kube`
	`3`	`+COPY --chmod=0555 ./coder-logstream-kube-${TARGETARCH} /coder-logstream-kube`
	`4`	`+USER 65532:65532`
`4`	`5`	`ENTRYPOINT ["/coder-logstream-kube"]`

Comments

(0)