From 1b7e26ef09243f6d222dcd333e52145545ec70f4 Mon Sep 17 00:00:00 2001
From: David AI <david-ai@localhost>
Date: Mon, 6 Jul 2026 14:51:15 +0000
Subject: [PATCH] sample-app: harden pod/container securityContext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Pod: runAsNonRoot, runAsUser/Group 1000 (matches Dockerfile's USER 1000),
  seccompProfile RuntimeDefault
- Container: allowPrivilegeEscalation false, readOnlyRootFilesystem true,
  drop all capabilities
- Verified locally with 'docker run --read-only --user 1000:1000
  --cap-drop ALL --security-opt no-new-privileges' — app has no disk
  writes, so no emptyDir volume needed for /tmp etc.
---
 apps/sample-app/base/deployment.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/apps/sample-app/base/deployment.yaml b/apps/sample-app/base/deployment.yaml
index 5f8e262..ebb3b34 100644
--- a/apps/sample-app/base/deployment.yaml
+++ b/apps/sample-app/base/deployment.yaml
@@ -14,9 +14,21 @@ spec:
       labels:
         app: sample-app
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: sample-app
           image: ghcr.io/david-uka/sample-app:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
           ports:
             - containerPort: 8080
           env: