You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can see `Strict` policy can exclude group `50000` from `groups`!
92
92
93
-
Thus, ensuring `supplementalGroupsPolicy: Merge` (enforced by some policy mechanism) helps prevent the implicit supplementary groups in a Pod.
93
+
Thus, ensuring `supplementalGroupsPolicy: Strict` (enforced by some policy mechanism) helps prevent the implicit supplementary groups in a Pod.
94
94
95
95
{{<note>}}
96
96
Actually, this is not enough because container with sufficient privileges / capability can change its process identity. Please see the following section for details.
0 commit comments