From 66ed55d78e7b01fb0bb40103f551c6b8ba753325 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sat, 3 Jan 2026 16:02:27 -0600
Subject: [PATCH] Add security context to meet PodSecurity restricted standard

- Set runAsNonRoot and runAsUser to 65534 (nobody)
- Disable privilege escalation
- Drop all Linux capabilities
- Use RuntimeDefault seccomp profile
- Applies to both migration job and main deployment
---
 k8s/deployment.yaml  | 15 +++++++++++++++
 k8s/migrate-job.yaml | 15 +++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index a99dc0df..b01bfbd9 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -16,10 +16,25 @@ spec:
     spec:
       imagePullSecrets:
       - name: gitlab-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: towerops
         image: registry.gitlab.com/graham/towerops:latest
         imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 65534
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         ports:
         - containerPort: 4000
           name: http
diff --git a/k8s/migrate-job.yaml b/k8s/migrate-job.yaml
index f79da0b7..3d085805 100644
--- a/k8s/migrate-job.yaml
+++ b/k8s/migrate-job.yaml
@@ -20,10 +20,25 @@ spec:
       restartPolicy: Never
       imagePullSecrets:
       - name: gitlab-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: migrate
         image: registry.gitlab.com/graham/towerops:IMAGE_TAG
         command: ["/app/bin/towerops", "eval", "Towerops.Release.migrate()"]
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 65534
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
         env:
         - name: MIX_ENV
           value: "prod"