Security best practices #298
Conversation
| # capabilities: | ||
| # drop: | ||
| # - ALL |
There was a problem hiding this comment.
Question: can't we drop all caps?
| # capabilities: | ||
| # drop: | ||
| # - ALL |
| # capabilities: | ||
| # drop: | ||
| # - ALL | ||
| # privileged: false |
There was a problem hiding this comment.
Sorry, I didn't understand your concern here
There was a problem hiding this comment.
Sorry, the comment is about line 197 - # privileged: false, but the UI rendered it as if it was for everything above.
My question is if we can explicitly set it to privileged: false.
There was a problem hiding this comment.
Got it! I changed it to explicitly set the value to false
diogoasouza
force-pushed
the
security-best-practices
branch
from
f13cf04 to
f5f6c93
Compare
macedogm
left a comment
macedogm
left a comment
There was a problem hiding this comment.
Made a suggestion on a line that I believe was missed. Additionally, can we set?
capabilities:
drop:
- ALL
f5f6c93 to
40bc06d
Compare
|
As @macedogm mentioned, if possible we should drop all capabilities by default. If it disrupts the application flow, then we can at least try dropping as many capabilities as we can by default. Otherwise LGTM |
diogoasouza
force-pushed
the
security-best-practices
branch
from
40bc06d to
2b5519a
Compare
4 participants
Issue #291