> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Solution Security Context

> This guide covers Kubernetes `securityContext` configurations for controlling process ownership and Linux capabilities in pods and containers.

This guide walks through common `securityContext` configurations in Kubernetes pods and containers, demonstrating how to control process ownership and Linux capabilities. You’ll see how to:

* Determine the user that runs a process inside a container
* Override container user IDs with `runAsUser`
* Grant specific capabilities (e.g., `SYS_TIME`, `NET_ADMIN`)

For more details, refer to the [Kubernetes Pod Security Context documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).

***

## 1. Which user executes the `sleep` process in the Ubuntu Sleeper pod?

Run `whoami` locally and inside the container:

```bash theme={null}
# Local shell
whoami
# Confirm pod is running
kubectl get pod
# NAME             READY   STATUS    RESTARTS   AGE
# Inside the container
kubectl exec ubuntu-sleeper -- whoami
# → root
```

**Answer:** The `sleep` process runs as **root** by default.

***

## 2. Edit the Ubuntu Sleeper pod to run the process as UID 1010

1. Export the existing Pod manifest:
   ```bash theme={null}
   kubectl get pod ubuntu-sleeper -o yaml > ubuntu-sleeper.yaml
   ```
2. In `ubuntu-sleeper.yaml`, add a container-level `securityContext`:
   ```yaml theme={null}
   spec:
     containers:
       - name: ubuntu
         image: ubuntu
         command: ["sleep", "4800"]
         securityContext:
           runAsUser: 1010
         # ...other fields...
   ```
3. Delete and recreate the Pod:
   ```bash theme={null}
   kubectl delete pod ubuntu-sleeper --force
   kubectl apply -f ubuntu-sleeper.yaml
   ```
4. Verify inside the container:
   ```bash theme={null}
   kubectl exec ubuntu-sleeper -- whoami
   # → 1010
   ```

<Callout icon="lightbulb" color="#1CB2FE">
  Using `--force` deletes the Pod immediately. In production clusters, prefer a graceful rollout (e.g., updating a Deployment).
</Callout>

**Result:** The `sleep` process now runs as UID **1010**.

***

## 3. Which user starts processes in the `web` container of `multi-pod.yaml`?

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: multi-pod
spec:
  securityContext:
    runAsUser: 1001      # pod-level default
  containers:
    - name: web
      image: ubuntu
      command: ["sleep", "5000"]
      securityContext:
        runAsUser: 1002  # container override
    - name: sidecar
      image: ubuntu
      command: ["sleep", "5000"]
      # no override → inherits pod-level
```

Container-level settings override pod-level defaults.

**Answer:** The `web` container runs as **1002**.

***

## 4. Which user starts processes in the `sidecar` container?

Since the `sidecar` container has no `runAsUser` block, it inherits from the Pod:

| Container | runAsUser |
| --------- | --------- |
| web       | 1002      |
| sidecar   | 1001      |

**Answer:** The `sidecar` container runs as **1001**.

***

## 5. Update Ubuntu Sleeper to run as root and add the `SYS_TIME` capability

1. Remove any `runAsUser` lines in `ubuntu-sleeper.yaml`.
2. Under the container’s `securityContext`, add the `SYS_TIME` capability:
   ```yaml theme={null}
   spec:
     containers:
       - name: ubuntu
         image: ubuntu
         command: ["sleep", "4800"]
         securityContext:
           capabilities:
             add:
               - SYS_TIME
   ```
3. Apply the changes:
   ```bash theme={null}
   kubectl delete pod ubuntu-sleeper --force
   kubectl apply -f ubuntu-sleeper.yaml
   ```

<Callout icon="triangle-alert" color="#FF6B6B">
  Granting `SYS_TIME` allows processes to modify the system clock. Only use this capability if absolutely necessary.
</Callout>

**Result:** The pod runs as **root** with the **SYS\_TIME** capability.

***

## 6. Add the `NET_ADMIN` capability to the Ubuntu Sleeper pod

Extend the same `securityContext` to include both capabilities:

```yaml theme={null}
spec:
  containers:
    - name: ubuntu
      image: ubuntu
      command: ["sleep", "4800"]
      securityContext:
        capabilities:
          add:
            - SYS_TIME
            - NET_ADMIN
```

Reapply the manifest:

```bash theme={null}
kubectl delete pod ubuntu-sleeper --force
kubectl apply -f ubuntu-sleeper.yaml
```

**Result:** The pod now has both **SYS\_TIME** and **NET\_ADMIN** capabilities.

***

## References

* [Pod Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
* [Container Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-of-a-container)
* [Capability Lists](https://man7.org/linux/man-pages/man7/capabilities.7.html)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/kubernetes-and-cloud-native-security-associate-kcsa/module/0148994b-9ccc-4725-a77b-a4a63592152f/lesson/f35655a9-b8e7-4bac-b6a1-85c2ca4900be" />
</CardGroup>