deploy: add patch for stricter pod security

Signed-off-by: Travis Johnson <[email protected]>

Author: tjohnson31415

deployment/base/deployment.yaml

@@ -23,6 +23,7 @@ spec:
 
           securityContext:
             allowPrivilegeEscalation: false
+            privileged: false
             runAsNonRoot: true
             seccompProfile:
               type: RuntimeDefault

deployment/base/patches/read-only-root-filesystem.yaml

@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: inference-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: server
+          env:
+            # set base directory for caches
+            - name: HF_HOME
+              value: /tmp/
+          securityContext:
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}