Unprivileged
unprivileged.tpl
(view on GitHub)
:
{{ range $name, $spec := .Workloads }}
{{ range $cname, $_ := $spec.containers }}
- op: set
path: services.{{ $name }}-{{ $cname }}.read_only
value: true
- op: set
path: services.{{ $name }}-{{ $cname }}.user
value: "65532"
- op: set
path: services.{{ $name }}-{{ $cname }}.cap_drop
value: ["ALL"]
{{ end }}
{{ end }}