Skip to content

Commit 78de298

Browse files
authored
Documenting read-only rootfs for issue 17927
Issue 17927 (#17927) asks for a change to this task-focused doc on security-context. It notes that this doesn't mention read-only root filesystem, while it's documented in the PSP page. This adds a bullet for read-only rootfs, clarifies that the bulleted list isn't comprehensive, and tells someone reading the list where to find more. The link is copied from the existing What's Next link list.
1 parent 7d05b90 commit 78de298

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

content/en/docs/tasks/configure-pod-container/security-context.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ weight: 80
1111
{{% capture overview %}}
1212

1313
A security context defines privilege and access control settings for
14-
a Pod or Container. Security context settings include:
14+
a Pod or Container. Security context settings include, but are not limited to:
1515

1616
* Discretionary Access Control: Permission to access an object, like a file, is based on
1717
[user ID (UID) and group ID (GID)](https://wiki.archlinux.org/index.php/users_and_groups).
@@ -28,6 +28,12 @@ a Pod or Container. Security context settings include:
2828

2929
* AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`.
3030

31+
* readOnlyRootFilesystem: Mounts the container's root filesystem as read-only.
32+
33+
The above bullets are not a complete set of security context settings -- please see
34+
[SecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#securitycontext-v1-core)
35+
for a comprehensive list.
36+
3137
For more information about security mechanisms in Linux, see
3238
[Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features)
3339

0 commit comments

Comments
 (0)