Run as Non Root (#149)

build/package/Dockerfile.run

@@ -5,4 +5,7 @@ RUN apk add --update --no-cache ca-certificates
 
 COPY Reloader /bin/Reloader
 
+# On alpine 'nobody' has uid 65534
+USER 65534
+
 ENTRYPOINT ["/bin/Reloader"]

deployments/kubernetes/chart/reloader/values.yaml

@@ -32,6 +32,10 @@ reloader:
     #             operator: "Exists"
     affinity: {}
 
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 65534
+
     # A list of tolerations to be applied to the Deployment.
     # Example:
     #   tolerations:

deployments/kubernetes/manifests/deployment.yaml

@@ -39,4 +39,7 @@ spec:
         name: reloader-reloader
         args:
       serviceAccountName: reloader-reloader
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
 

deployments/kubernetes/reloader.yaml

@@ -106,6 +106,9 @@ spec:
         name: reloader-reloader
         args:
       serviceAccountName: reloader-reloader
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
 
 ---
 # Source: reloader/templates/role.yaml