Why this matters
Reduces blast radius and prevents privileged writes if compromised.
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
Reduces blast radius and prevents privileged writes if compromised.
Side-by-side examples engineers can pattern-match during review.
apiVersion: apps/v1
kind: Deployment
spec:
template:
spec:
containers:
- name: app
image: app:1.0
apiVersion: apps/v1
kind: Deployment
spec:
template:
spec:
securityContext:
runAsNonRoot: true
containers:
- name: app
image: app:1.0
securityContext:
runAsUser: 1000
readOnlyRootFilesystem: true
securityContext:
runAsNonRoot: true
runAsUser: 1000securityContext:
runAsUser: 0From the same buckets as this rule.