Exercise: make the workload immutable without killing it

Host: controlplane · Time: 8 min · Domain: Monitoring, Logging and Runtime Security

Task

• Deployment web in prod must have a read-only root filesystem.
• It must stay Running.
• No container may run as root.

Acceptance criteria

• kubectl get deploy web -n prod -o jsonpath='{..readOnlyRootFilesystem}' → true
• The Deployment has 1 ready replica after 60 s.
• kubectl exec deploy/web -n prod -- touch /x fails.

Solution

      securityContext:
        runAsNonRoot: true
        runAsUser: 101
      containers:
      - name: nginx
        image: nginxinc/nginx-unprivileged:1.27
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          capabilities: {drop: ["ALL"]}
        volumeMounts:
        - {name: cache, mountPath: /var/cache/nginx}
        - {name: run, mountPath: /var/run}
        - {name: tmp, mountPath: /tmp}
      volumes:
      - {name: cache, emptyDir: {}}
      - {name: run, emptyDir: {}}
      - {name: tmp, emptyDir: {}}

Three emptyDirs because nginx writes to three places at startup. Add them
before you set the flag, not after the CrashLoop.