Settings that constrain a container.
WHAT A SECURITY CONTEXT SETS
The user and group to run as Whether privilege escalation is permitted Which capabilities are held Whether the filesystem is read-only Which kernel call filter applies
WHAT TO SET ON EVERY WORKLOAD
Run as a non-root user Disallow privilege escalation Drop all capabilities Read-only root filesystem, where possible
WHY DISALLOWING ESCALATION MATTERS
It prevents a process gaining more privileges than it started with.
WHAT CAPABILITIES TO ADD BACK
Only what the application demonstrably needs.
WHAT MOST APPLICATIONS NEED
Nothing.
WHAT A READ-ONLY FILESYSTEM REQUIRES
Writable mounts for temporary files and anything the application writes.
WHAT TO MOUNT FOR THAT
A small temporary volume.
WHAT A KERNEL CALL FILTER DOES
Restricts which kernel operations are permitted.
WHAT THE DEFAULT PROFILE BLOCKS
Operations almost no application needs.
WHAT TO AVOID DISABLING
That profile, which people turn off to fix an error rather than investigating it.
WHAT PRIVILEGED MODE DOES
Removes essentially all restrictions.
WHEN IT IS JUSTIFIED
Almost never, outside specific infrastructure components.
WHAT TO ENFORCE
These settings through admission policy, not documentation.
WHAT TO TEST
That the application works under them.
