What is a Security Context and how do you configure it?

A Security Context defines privilege and access control settings for a Pod or Container. It allows you to set user IDs, group IDs, filesystem permissions, and security capabilities.

Key Security Context Options:

• runAsUser/runAsGroup: Run container as specific user/group
• runAsNonRoot: Ensure container doesn't run as root
• readOnlyRootFilesystem: Make root filesystem read-only
• allowPrivilegeEscalation: Control privilege escalation
• capabilities: Add/drop Linux capabilities

Example:

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    runAsNonRoot: true
    fsGroup: 2000
  containers:
  - name: app
    image: nginx
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE