readOnlyRootFilesystem

  containerSecurityContext:
   enabled: true
   runAsUser: 11111
   runAsGroup: 11111
   allowPrivilegeEscalation: false
   capabilities:
     drop:
       - all
   readOnlyRootFilesystem: false
   runAsNonRoot: true

Related

• allowPrivilegeEscalation
• Configure a Security Context for a Pod or Container

See also

• Kubernetes security, OPA, EKS security, PSA, PSS, CKS, SecurityContext, containerSecurityContext, Trivy, KubeBench, Kubernetes Admission Controllers admissionregistration.k8s.io, Hardeneks, Gatekeeper (Kubernetes), kubernetes.io/enforce-mountable-secrets, Auditing, security context, readOnlyRootFilesystem, allowPrivilegeEscalation, kube-bench