You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Issue 17927 (#17927) asks for a change to this task-focused doc on security-context. It notes that this doesn't mention read-only root filesystem, while it's documented in the PSP page. This adds a bullet for read-only rootfs, clarifies that the bulleted list isn't comprehensive, and tells someone reading the list where to find more. The link is copied from the existing What's Next link list.
Copy file name to clipboardExpand all lines: content/en/docs/tasks/configure-pod-container/security-context.md
+7-1Lines changed: 7 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ weight: 80
11
11
{{% capture overview %}}
12
12
13
13
A security context defines privilege and access control settings for
14
-
a Pod or Container. Security context settings include:
14
+
a Pod or Container. Security context settings include, but are not limited to:
15
15
16
16
* Discretionary Access Control: Permission to access an object, like a file, is based on
17
17
[user ID (UID) and group ID (GID)](https://wiki.archlinux.org/index.php/users_and_groups).
@@ -28,6 +28,12 @@ a Pod or Container. Security context settings include:
28
28
29
29
* AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`.
30
30
31
+
* readOnlyRootFilesystem: Mounts the container's root filesystem as read-only.
32
+
33
+
The above bullets are not a complete set of security context settings -- please see
0 commit comments