Docs

Volcengine Kubernetes Engine

Container configuration

Configuring security contexts

This topic describes how to configure security contexts for pods or containers in VCI, which define the permissions and access control of the pods or containers.

Background information

Security Contexts are used to define the permissions and access control of pods or containers, such as discretionary access control, SELinux, and Linux capabilities. For more information, see Security Contexts.

Kubernetes provides security context configuration methods at both the pod and container levels:

Pod security contexts: Apply to all containers and volumes within a pod. For the parameters supported by Kubernetes, see Pod security context API.

Container security context: Applies to the specified container. For the parameters supported by Kubernetes, see Security context API.

Configuring pod security contexts

VCI allows you to modify sysctls, runAsUser, and runAsGroup by using pod security contexts.

Parameter description

Parameters that can be specified	Type	Description	Kubernetes API
sysctls	List<Sysctl>	The kernel parameters of the VCI, including: kernel.shm* (excluding kernel.shm_next_id and kernel.shm_rmid_forced) kernel.msg* (excluding kernel.msg_next_id) kernel.sem fs.mqueue.* net.* (excluding net.ipv4.ip_local_port_range and net.ipv4.tcp_syncookies) vm.min_free_kbytes	Sysctl v1 core
runAsUser	integer	The user ID to run the container. If specified, it overrides the USER instruction in the Dockerfile.	-
runAsGroup	integer	The user group ID to run containers. If specified, all processes in all containers within the specified pod will run with this user group ID. Warning If runAsGroup is specified, runAsUser must also be specified.	-

Configuration examples

Sample parameters for sysctls:

apiVersion: v1
kind: Pod
metadata:
name: security-context-pod-sysctls-demo
spec:
securityContext: #Pod-level security context configuration
sysctls: #sysctls parameters
- name: kernel.shmmax
value: "18446744073692774399"
- name: kernel.msgmax
value: "8192"
- name: kernel.sem
value: "32000 1024000000 500 32000"
containers:
- name: busybox
image: busybox
command: ["sh", "-c", "sleep 10000"]

Example parameters for runAsUser:

apiVersion: v1
kind: Pod
metadata:
name: security-context-pod-runAsUser-demo
spec:
securityContext: # Pod-level security context configuration
runAsUser: 1000 #runAsUser parameters
containers:
- name: busybox
image: busybox
command: ["sh", "-c", "sleep 10000"]

Example parameters for runAsGroup:

apiVersion: v1
kind: Pod
metadata:
name: security-context-pod-runAsUser-demo
spec:
securityContext: #Pod-level security context configuration
runAsUser: 1000 #runAsUser parameters
runAsGroup: 1000 #runAsGroup parameters
containers:
- name: busybox
image: busybox
command: ["sh", "-c", "sleep 10000"]

Configuring container security contexts

VCI allows you to modify runAsUser, runAsGroup, and capabilities by using container security contexts.

tip

If you configure shared parameters (such as runAsUser) in both the pod and container security contexts, the container's settings will override the pod's settings.

Parameter description

Configurable parameter	Type	Description	Kubernetes API
runAsUser	integer	The user ID to run the container. If specified, it overrides the USER instruction in the Dockerfile.	-
runAsGroup	integer	The user group ID to run the container. If specified, all processes in the specified container run with the user group ID.	-
capabilities	List<String>	Grant some specific permissions to processes running in the container. You can grant the following permissions: AUDIT_WRITE CHOWN DAC_OVERRIDE FSETID FOWNER KILL MKNOD NET_ADMIN NET_BIND_SERVICE NET_RAW SETGID SETUID SETFCAP SETPCAP SYS_CHROOT SYS_PTRACE SYS_RAWIO SYS_TIME tip SYS_RAWIO and SYS_TIME are at the beta stage. To use these capabilities, submit a ticket to apply.	Capabilities v1 core

The following table describes some parameters that cannot be specified.

Parameters that cannot be specified	Description	Native Kubernetes API
privileged	Whether to run the container in privileged mode. Processes in a privileged container have root privileges equivalent to those on the host. The default value is false.	Yes
readOnlyRootFilesystem	Specifies whether the container's root filesystem is read-only. The default value is false, which means the root filesystem is readable and writable.	Yes
procMount	Specify the type of proc that the container can mount. The default value is DefaultProcMount.	Yes

Configuration examples

Example parameters for runAsUser:

apiVersion: v1
kind: Pod
metadata:
name: security-context-container-runAsUser-demo
spec:
containers:
- name: busybox01
image: busybox
command: ["sh", "-c", "sleep 10000"]
- name: busybox02
image: busybox
command: ["sh", "-c", "sleep 10000"]
securityContext: #Container-level security context configuration
runAsUser: 2000 #Container-level runAsUser parameters

Example parameters for runAsGroup:

apiVersion: v1
kind: Pod
metadata:
name: security-context-container-runAsUser-demo
spec:
containers:
- name: busybox01
image: busybox
command: ["sh", "-c", "sleep 10000"]
- name: busybox02
image: busybox
command: ["sh", "-c", "sleep 10000"]
securityContext: #Container-level security context configuration
runAsGroup: 2000 #Container-level runAsGroup parameters

Example parameters for capabilities:

apiVersion: v1
kind: Pod
metadata:
name: security-context-container-runAsUser-demo
spec:
containers:
- name: busybox01
image: busybox
command: ["sh", "-c", "sleep 10000"]
securityContext: # Container-level security context configuration
capabilities: # capabilities parameters
add: ["NET_ADMIN", "CHOWN", "SYS_CHROOT"]

Last updated: 2026.07.24 16:18:03