Isolation and Segmentation Security Context

• How to mirror Docker security options in Kubernetes
• The difference between Pod-level and Container-level configurations
• Best practices for applying user IDs and Linux capabilities

​

Why Security Contexts Matter

• Define which Linux user or group a container runs as
• Grant or restrict Linux capabilities (e.g., NET_ADMIN, SYS_TIME)
• Enable Pod-level settings that apply to all containers

# Run container as a specific user
docker run --user=1001 ubuntu sleep 3600

# Grant a Linux capability
docker run --cap-add MAC_ADMIN ubuntu

​

Security Context Levels

​

Pod-Level Security Context

apiVersion: v1
kind: Pod
metadata:
  name: web-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  containers:
    - name: ubuntu
      image: ubuntu
      command: ["sleep", "3600"]

​

Container-Level Security Context

apiVersion: v1
kind: Pod
metadata:
  name: web-pod
spec:
  containers:
    - name: ubuntu
      image: ubuntu
      command: ["sleep", "3600"]
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        capabilities:
          add: ["MAC_ADMIN", "NET_RAW"]
          drop: ["ALL"]
        privileged: false

​

Best Practices

• Always run containers as non-root users (runAsUser ≥ 1000).
• Use Pod-level context for uniform settings; override at the container level only when needed.
• Drop unnecessary capabilities (capabilities.drop: ["ALL"]) and add only those required.

​

Further Reading

• Kubernetes Pods Security Context
• Docker Run Reference
• Understanding Linux Capabilities