Merge pull request #539 from aryan9600/aryan9600/security-context

Drop capabilities, enable seccomp and enforce runAsNonRoot
fluxcd · Jan 20, 2022 · 12d9fab · 12d9fab
2 parents 91e96a2 + c0d5eee
commit 12d9fab
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -43,9 +43,7 @@ COPY --from=builder /workspace/kustomize-controller /usr/local/bin/
 # https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460
 RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
 
-RUN addgroup -S controller && adduser -S controller -G controller
-
-USER controller
+USER 65534:65534
 
 ENV GNUPGHOME=/tmp
 

diff --git a/config/manager/deployment.yaml b/config/manager/deployment.yaml
@@ -29,6 +29,12 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop: [ "ALL" ]
+          seccompProfile:
+            type: RuntimeDefault
+
         ports:
           - containerPort: 8080
             name: http-prom