Merge pull request #223 from aryan9600/aryan9600/security-context

Drop capabilities, enable seccomp and enforce runAsNonRoot
fluxcd · Jan 20, 2022 · 86d5c29 · 86d5c29
2 parents 0c10cf0 + d454180
commit 86d5c29
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -45,8 +45,6 @@ RUN apk add --no-cache ca-certificates tini
 
 COPY --from=builder /workspace/image-reflector-controller /usr/local/bin/
 
-RUN addgroup -S controller && adduser -S controller -G controller
-
-USER controller
+USER 65534:65534
 
 ENTRYPOINT [ "/sbin/tini", "--", "image-reflector-controller" ]
diff --git a/config/manager/deployment.yaml b/config/manager/deployment.yaml
@@ -29,6 +29,11 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop: [ "ALL" ]
+          seccompProfile:
+            type: RuntimeDefault
         ports:
           - containerPort: 8080
             name: http-prom