FROM openjdk:8-jdk-alpine

RUN groupadd appgroup && useradd -G appgroup appuser
USER appuser

apiVersion: v1  
kind: Pod  
metadata:  
  name: hello-world  
spec:  
  containers:  
  # specification of the pod’s containers  
  # ...  
  securityContext:  
    readOnlyRootFilesystem: true  
    runAsNonRoot: true

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo-4
spec:
  containers:
  - name: sec-ctx-4
    image: gcr.io/google-samples/node-hello:1.0
    securityContext:
      capabilities:
        add: ["NET_ADMIN", "SYS_TIME"]

          resources:
            limits:
              cpu: "1"
              memory: "1Gi"
            requests:
              cpu: "500m"
              memory: "500Mi"

          readinessProbe:
            httpGet:
              port: http
              path: /actuator/health/readiness
            failureThreshold: 3
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              port: http
              path: /actuator/health/liveness
            failureThreshold: 3
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          startupProbe:
            httpGet:
              port: http
              path: /actuator/health
            initialDelaySeconds: 30
            failureThreshold: 5
            periodSeconds: 10