Merge pull request #77 from rhysm/securityContext

Add securityContext to make container run as non-root user.
omrikiei · Feb 16, 2022 · cb8f997 · cb8f997
2 parents 0da3631 + 05b502b
commit cb8f997
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/pkg/k8s/common.go b/pkg/k8s/common.go
@@ -148,6 +148,7 @@ func newContainer(port int, image string, containerPorts []apiv1.ContainerPort,
 	cpuLimit.SetMilli(int64(1000))
 	memRequest.SetScaled(int64(100), resource.Mega)
 	memLimit.SetScaled(int64(1), resource.Giga)
+	containerUid := int64(1000)
 
 	return &apiv1.Container{
 		Name:    "ktunnel",
@@ -165,6 +166,9 @@ func newContainer(port int, image string, containerPorts []apiv1.ContainerPort,
 				"memory": memLimit,
 			},
 		},
+		SecurityContext: &apiv1.SecurityContext{
+			RunAsUser: &containerUid,
+		},
 	}
 }