World map

 

BM

World K6: Guards

securityContext: lock the lunchbox

You will learn: the four locks the restricted level wants, and where each one goes.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

A thief breaks into one lunchbox: your shop’s container. It runs as root, with every power on. How far can the thief get?

Watch

Lock 1 goes on the whole tray. securityContext: The locks on a lunchbox: no root, no extra powers, a seccomp filter, read-only files. holds the locks. Tap the two lines that stop root.

Tap every line that keeps the cook from being root.

0 of 2 found

Watch

You are here: cluster kind-dev namespace default

The tray locks are not enough. Each container needs two more. capabilities: Small slices of root's power, like changing the network. Drop them ALL unless you need one. are slices of root’s power. Drop them all:

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

Try it

Mei put a container lock on the tray. The API server does not know it there. Move it into the container.

Fix the manifest, then press Apply.

tray.yaml13 lines

Try it

Two trays wait in your folder. cat them, then apply the one the guard accepts.

You are here: cluster kind-dev namespace default
dev-control-planeOpenManager

No trays here.

dev-workerOpen

No trays here.

dev-worker2Open

No trays here.

Time: +0s (sped up)

Predict

You add readOnlyRootFilesystem: true. The app writes a temp file to /tmp. What happens?

Check

Where can each lock go? Sort them.

Drag a card into a box. Or tap the card, then tap the box.

      You did it!

      You can now lock a lunchbox with securityContext.

      Go deeper (optional)

      Restricted lets one power back in: NET_BIND_SERVICE, for ports under 1024. Many images run as root by default. With runAsNonRoot: true and a root image, the kubelet refuses to start it: CreateContainerConfigError. Pick a non-root image, or set runAsUser.

      Real mission

      1. kubectl create namespace locks && kubectl label ns locks pod-security.kubernetes.io/enforce=restricted
      3. kubectl apply -n locks -f locked.yaml
      4. kubectl exec -n locks locked -- id

      0 of 4 steps done · Your ticks are saved.