feat: support a more secure security-context

spacelift-io · Sep 17, 2024 · 0d7b3fd · 0d7b3fd
1 parent 1525632
commit 0d7b3fd
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/spacelift-promex/templates/deployment.yaml b/spacelift-promex/templates/deployment.yaml
@@ -40,6 +40,15 @@ spec:
           ports:
             - name: metrics
               containerPort: 9953
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            seccompProfile:
+              type: "RuntimeDefault"
+            runAsUser: 1983
           readinessProbe:
             httpGet:
               path: /health