Container Security

Make containers pass Kupe’s baseline security requirements at deploy time.

Required security settings

Every container must include these security context settings:

spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - name: my-app
      securityContext:
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 500m
          memory: 256Mi

What each setting does

Setting	Required	Purpose
`runAsNonRoot: true`	Yes	Prevents running as UID 0 (root)
`allowPrivilegeEscalation: false`	Yes	Blocks setuid binaries from gaining privileges
`capabilities.drop: ["ALL"]`	Yes	Removes all Linux capabilities
`readOnlyRootFilesystem: true`	Recommended	Prevents writing to the container filesystem
`seccompProfile.type: RuntimeDefault`	Recommended	Restricts available syscalls

Required settings are enforced — violations are blocked. Recommended settings are currently logged in audit mode.

Building non-root images

Most official images already support non-root. If you’re building your own:

FROM alpine:3.21

# Create non-root user
RUN addgroup -g 65532 -S app && \
    adduser -u 65532 -S app -G app

# Set ownership
COPY --chown=app:app ./bin/myapp /app/myapp

# Switch to non-root
USER 65532

ENTRYPOINT ["/app/myapp"]

Using writable directories

With readOnlyRootFilesystem: true, use emptyDir volumes for directories that need writes (temp files, caches, uploads):

containers:
  - name: app
    securityContext:
      readOnlyRootFilesystem: true
    volumeMounts:
      - name: tmp
        mountPath: /tmp
      - name: cache
        mountPath: /app/cache
volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir:
      sizeLimit: 100Mi

Adding capabilities back

If your application needs a specific capability (e.g., binding to ports below 1024), you can add it back after dropping all:

securityContext:
  capabilities:
    drop: ["ALL"]
    add: ["NET_BIND_SERVICE"]

NET_BIND_SERVICE is the only capability you can add back yourself. If your workload genuinely needs a different capability, request a platform-issued policy exception through the process in Cluster Policies — there is no self-service annotation for it.

Common issues

”exec format error” after switching to non-root

Your image may use a shell script entrypoint without a shebang line. Add #!/bin/sh as the first line, or use the binary directly as the entrypoint.

Application writes to root filesystem

Move writes to an emptyDir volume. Common paths that need this:

/tmp — temp files
/var/cache — application caches
/var/log — log files (prefer stdout instead)
/app/data — application data (use a PVC for persistence)

Cluster Policies — full policy reference
Network Isolation — egress restrictions