Solution Security Context

• Determine the user that runs a process inside a container
• Override container user IDs with runAsUser
• Grant specific capabilities (e.g., SYS_TIME, NET_ADMIN)

​

1. Which user executes the sleep process in the Ubuntu Sleeper pod?

# Local shell
whoami
# Confirm pod is running
kubectl get pod
# NAME             READY   STATUS    RESTARTS   AGE
# Inside the container
kubectl exec ubuntu-sleeper -- whoami
# → root

​

2. Edit the Ubuntu Sleeper pod to run the process as UID 1010

1. Export the existing Pod manifest:
   kubectl get pod ubuntu-sleeper -o yaml > ubuntu-sleeper.yaml
   
2. In ubuntu-sleeper.yaml, add a container-level securityContext:
   spec:
     containers:
       - name: ubuntu
         image: ubuntu
         command: ["sleep", "4800"]
         securityContext:
           runAsUser: 1010
         # ...other fields...
   
3. Delete and recreate the Pod:
   kubectl delete pod ubuntu-sleeper --force
   kubectl apply -f ubuntu-sleeper.yaml
   
4. Verify inside the container:
   kubectl exec ubuntu-sleeper -- whoami
   # → 1010
   

​

3. Which user starts processes in the web container of multi-pod.yaml?

apiVersion: v1
kind: Pod
metadata:
  name: multi-pod
spec:
  securityContext:
    runAsUser: 1001      # pod-level default
  containers:
    - name: web
      image: ubuntu
      command: ["sleep", "5000"]
      securityContext:
        runAsUser: 1002  # container override
    - name: sidecar
      image: ubuntu
      command: ["sleep", "5000"]
      # no override → inherits pod-level

​

4. Which user starts processes in the sidecar container?

​

5. Update Ubuntu Sleeper to run as root and add the SYS_TIME capability

1. Remove any runAsUser lines in ubuntu-sleeper.yaml.
2. Under the container’s securityContext, add the SYS_TIME capability:
   spec:
     containers:
       - name: ubuntu
         image: ubuntu
         command: ["sleep", "4800"]
         securityContext:
           capabilities:
             add:
               - SYS_TIME
   
3. Apply the changes:
   kubectl delete pod ubuntu-sleeper --force
   kubectl apply -f ubuntu-sleeper.yaml
   

​

6. Add the NET_ADMIN capability to the Ubuntu Sleeper pod

spec:
  containers:
    - name: ubuntu
      image: ubuntu
      command: ["sleep", "4800"]
      securityContext:
        capabilities:
          add:
            - SYS_TIME
            - NET_ADMIN

kubectl delete pod ubuntu-sleeper --force
kubectl apply -f ubuntu-sleeper.yaml

​

References

• Pod Security Context
• Container Security Context
• Capability Lists