Commit4250c23

committed

run image as non-root user & add securitycontext values

1 parenta5bd376 commit4250c23Copy full SHA for 4250c23

File tree

+19

-2

lines changed

+19

-2

lines changed

Lines changed: 4 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -98,6 +98,10 @@ spec:`
`98`	`98`	`nodeSelector:`
`99`	`99`	`{{- toYaml . \| nindent 8 }}`
`100`	`100`	`{{- end }}`
	`101`	`+{{- with .Values.podSecurityContext }}`
	`102`	`+podSecurityContext:`
	`103`	`+{{- toYaml . \| nindent 8 }}`
	`104`	`+{{- end }}`
`101`	`105`	`containers:`
`102`	`106`	`-name:coder-logstream-kube`
`103`	`107`	`image:"{{ .Values.image.repo }}:{{ .Values.image.tag \| default .Chart.AppVersion }}"`

Lines changed: 13 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -92,7 +92,14 @@ labels: {}`
`92`	`92`
`93`	`93`	`# securityContext -- Container-level security context`
`94`	`94`	`# See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/`
`95`		`-securityContext:{}`
	`95`	`+securityContext:`
	`96`	`+runAsNonRoot:true`
	`97`	`+runAsUser:65532`
	`98`	`+runAsGroup:65532`
	`99`	`+allowPrivilegeEscalation:false`
	`100`	`+# Optional; enable after validation if the app never writes to disk:`
	`101`	`+# readOnlyRootFilesystem: true`
	`102`	`+#`
`96`	`103`	`# allowPrivilegeEscalation: false`
`97`	`104`	`# capabilities:`
`98`	`105`	`# drop:`
`@@ -101,3 +108,8 @@ securityContext: {}`
`101`	`108`	`# runAsNonRoot: true`
`102`	`109`	`# seccompProfile:`
`103`	`110`	`# type: RuntimeDefault`
	`111`	`+`
	`112`	`+podSecurityContext:{}`
	`113`	`+# Optional, only if your cluster requires group ownership for mounted volumes:`
	`114`	`+# podSecurityContext:`
	`115`	`+# fsGroup: 65532`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`FROM --platform=$BUILDPLATFORM scratch AS base`
`2`	`2`	`ARG TARGETARCH`
`3`		`-COPY ./coder-logstream-kube-${TARGETARCH} /coder-logstream-kube`
	`3`	`+COPY --chmod=0555 ./coder-logstream-kube-${TARGETARCH} /coder-logstream-kube`
	`4`	`+USER 65532:65532`
`4`	`5`	`ENTRYPOINT ["/coder-logstream-kube"]`

Comments

(0)