컨테이너 실행 유저 설정하기

1. pod scope로 컨테이너 실행 유저 설정 

#pod spec영역에 설정 
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext: #containers와 같은 레벨에 작성 
    runAsUser: 1000
  containers:
  - name: sec-ctx-demo
    image: busybox:1.28
    command: [ "sh", "-c", "sleep 1h" ]

 

2. container scope로 실행 유저 설정 

#정의파일
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo-2
spec:
  securityContext:
    runAsUser: 1000
  containers:
  - name: sec-ctx-demo-2
    image: gcr.io/google-samples/hello-app:2.0
    securityContext: #컨테이너 정의 영역에 명시
      runAsUser: 2000
      allowPrivilegeEscalation: false

 

 

 

 

reference 
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

Configure a Security Context for a Pod or Container

 

 

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container