The worker Pod in citadel-se3l0x runs as the image's default user:
sh
kubectl exec worker -n citadel-se3l0x -- idReplace it with a hardened version:
sh
kubectl delete pod worker -n citadel-se3l0x
kubectl apply -n citadel-se3l0x -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
name: worker
spec:
securityContext:
runAsUser: 1000
runAsGroup: 3000
volumes:
- name: scratch
emptyDir: {}
containers:
- name: worker
image: busybox
command: ["sleep", "3600"]
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
volumeMounts:
- name: scratch
mountPath: /scratch
EOF
kubectl exec worker -n citadel-se3l0x -- id
kubectl exec worker -n citadel-se3l0x -- sh -c "echo hi > /tmp/hi"
kubectl exec worker -n citadel-se3l0x -- sh -c "echo hi > /scratch/hi && cat /scratch/hi"Finally, a Pod that insists on non-root but forgets to say which user:
sh
kubectl apply -n citadel-se3l0x -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
name: strict
spec:
containers:
- name: web
image: nginx:1.27
securityContext:
runAsNonRoot: true
EOF
kubectl get pod strict -n citadel-se3l0x