L8. Security Contexts: runAsNonRoot, Capabilities and Seccomp

What Is a Security Context?

A security context defines privilege and access control settings for a pod or container. It maps directly to Linux kernel security features: user IDs, capabilities, seccomp filters, and filesystem permissions.

Security contexts can be set at two levels:

• Pod level: Applies to all containers in the pod (plus init containers)
• Container level: Overrides pod-level settings for a specific container

runAsNonRoot and runAsUser

Running containers as root is the single most common Kubernetes security mistake. A root user inside a container has UID 0, which maps to root on the host in many container escape scenarios.

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  containers:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">name: app</li>
</ul>
      image: my-app:latest
      securityContext:
        allowPrivilegeEscalation: false

runAsNonRoot: true makes Kubernetes reject the pod if the container image specifies USER root or UID 0. runAsUser: 1000 explicitly sets the UID.

Linux Capabilities

Linux capabilities break root privileges into granular units. Instead of granting full root, you can assign specific capabilities like NET_BIND_SERVICE (bind to ports below 1024).

The secure approach: drop all capabilities and add back only what is needed:

containers:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">name: app</li>
</ul>
    securityContext:
      capabilities:
        drop:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">ALL</li>
</ul>
        add:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">NET_BIND_SERVICE</li>
</ul>

Dangerous capabilities to never grant unless absolutely necessary:

• SYS_ADMIN: Nearly equivalent to full root
• SYS_PTRACE: Allows process inspection and manipulation
• NET_RAW: Enables raw socket creation (used in ARP spoofing)
• SYS_MODULE: Allows loading kernel modules

Seccomp Profiles

Seccomp (Secure Computing) filters restrict which Linux system calls a container can make. The RuntimeDefault profile blocks approximately 50 dangerous syscalls while allowing normal application behavior:

securityContext:
  seccompProfile:
    type: RuntimeDefault

For stricter control, create custom seccomp profiles that whitelist only the specific syscalls your application uses. Tools like strace and inspektor-gadget can profile your application to generate a minimal syscall list.

Read-Only Root Filesystem

Prevent containers from writing to their filesystem. This blocks many post-exploitation techniques like dropping malware binaries or modifying configuration files:

containers:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">name: app</li>
</ul>
    securityContext:
      readOnlyRootFilesystem: true
    volumeMounts:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">name: tmp</li>
</ul>
        mountPath: /tmp
volumes:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">name: tmp</li>
</ul>
    emptyDir: {}

Use emptyDir volumes for directories that need to be writable (like /tmp).