Security Contexts

Security Contexts define privilege and access control settings for pods and containers in the MATIH platform. They control which user ID the container runs as, whether it can escalate privileges, filesystem access permissions, and Linux capabilities.

Pod Security Context vs. Container Security Context

Standard Security Context

The MATIH platform defines a standard security context applied to most services:

# Pod-level security context
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  seccompProfile:
    type: RuntimeDefault
 
# Container-level security context
securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL

Service-Specific Overrides

Some services require non-standard security contexts due to upstream image requirements:

Verifying Container UID

Before setting security contexts, the actual container UID must be verified:

# Verification is done during chart development
# See CLAUDE.md Rule 2: VERIFY Container UID/GID

If the container UID does not match the security context runAsUser, the pod will fail with CreateContainerConfigError and the message container has runAsNonRoot and image will run as root.

Helm Values Configuration

Security contexts are configured through Helm values:

# values.yaml (base defaults)
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
 
securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL
 
# values-dev.yaml (development overrides for third-party images)
podSecurityContext:
  runAsNonRoot: false  # Override if image requires root

Helm Deep Merge Considerations

When overriding security contexts in environment-specific values files, be aware of Helm deep merge behavior:

• If base values.yaml sets runAsGroup: 1000 and dev override only sets runAsUser: 0, the merged result will have both runAsUser: 0 AND runAsGroup: 1000
• Always override ALL security context fields together to prevent value leakage

Writable Directories

For containers with readOnlyRootFilesystem: true, writable directories are provided via emptyDir volumes:

volumeMounts:
  - name: tmp
    mountPath: /tmp
  - name: cache
    mountPath: /home/appuser/.cache
 
volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir:
      sizeLimit: 100Mi

Common Issues