0Pricing
Helm Academy · Lesson

Hardening Pods with securityContext

Baking least-privilege defaults into templates.

Hardening Pods with securityContext is a free Helm Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Helm Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Harden by Default

A chart that ships least-privilege defaults protects every cluster that installs it. Security baked into templates beats hoping users remember to add it.

Two Levels of securityContext

You can set a securityContext at the pod level for all containers, and a narrower one per container. The container setting overrides the pod for that container.

Don't Run as Root

Set runAsNonRoot to true so Kubernetes refuses to start a container that would run as root. It is the single highest-impact default you can ship.

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

Read-Only Root Filesystem

Turn on readOnlyRootFilesystem so the container cannot write to its own image layers. Mount an emptyDir for any paths the app truly needs to write.

containers:
- name: app
  securityContext:
    readOnlyRootFilesystem: true

Drop Linux Capabilities

Most apps need no special kernel powers, so drop ALL capabilities and add back only the rare one a workload genuinely requires.

capabilities:
  drop:
    - ALL

Block Privilege Escalation

Set allowPrivilegeEscalation to false so a process can never gain more privileges than it started with, even via setuid binaries. 🔒

allowPrivilegeEscalation: false

Set the fsGroup

Use fsGroup in the pod securityContext so mounted volumes are owned by a group the non-root user belongs to, avoiding permission errors.

securityContext:
  fsGroup: 2000

Never Set privileged True

A privileged container has near-full host access and should essentially never appear in a chart default. Leave it unset, which means false.

Make It Overridable

Wire the securityContext to values with toYaml so users can adjust it, but keep the hardened settings as your safe defaults.

securityContext:
  {{- toYaml .Values.securityContext | nindent 4 }}

Align with Pod Security Standards

These defaults map to the Kubernetes restricted Pod Security Standard, so your chart installs cleanly even in tightly locked-down namespaces.

Verify After Install

Confirm the hardening took effect by inspecting the running pod's spec with kubectl get pod -o yaml and checking the securityContext fields.

kubectl get pod myapp -o jsonpath='{.spec.securityContext}'

Quick Check

Which setting stops a container from starting if it would run as the root user?

Recap

You hardened pods with runAsNonRoot, dropped capabilities, a read-only filesystem, and no privilege escalation. Safe defaults protect every install. ✅

Frequently asked questions

Is the “Hardening Pods with securityContext” lesson free?

Yes — the full text of “Hardening Pods with securityContext” is free to read here on the web, and the Helm Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Helm Academy course, upgrade to CoddyKit PRO.

What will I learn in “Hardening Pods with securityContext”?

Baking least-privilege defaults into templates. You practise Helm Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Helm Academy?

No prior experience is required. Helm Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Hardening Pods with securityContext” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Helm Academy lesson?

Yes. Every Helm Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Standard Labels and Naming Conventions
  2. Sane, Documented Default Values
  3. Hardening Pods with securityContext
  4. Pinning Versions and Avoiding latest
← Back to Helm Academy