Overview

By default, Polyaxon operations run without a security context, and pods run as root. Container-only settings such as privileged are not part of the Pod security context, see Container-only settings.

Defining a security context preset

If you need to configure a security context for your jobs and services, you can use the environment.securityContext section:

runPatch:
  environment:
    securityContext:
      runAsUser: 2222
      runAsGroup: 2222
      runAsNonRoot: true

By saving this preset as security-context, users can now use this section in their jobs or services automatically:

polyaxon run ... --presets=security-context

You can also use the preset directly on the component or operation definition:

kind: operation
presets: [security-context]
...

Global or per project security context

Organization and project administrators can add a security-context preset to the ordered Selected Presets list under Settings > Defaults.

Setting the organization's default presets:

Setting a project's default presets:

Chart default for all runs

If you deploy with Helm, the chart's security context can also be the default for run pods, so services and runs share one user and you don't need a preset:

securityContext:
  enabled: true
  applyToRuns: true

The agent then adds runAsUser, runAsGroup, fsGroup and fsGroupChangePolicy to every job, service, distributed replica and cleaner that doesn't set environment.securityContext. If the chart leaves fsGroupChangePolicy empty, run pods use OnRootMismatch, so Kubernetes doesn't walk the whole store each time a run starts.

applyToRuns does nothing when enabled is false. Turning it off only affects new pods: running pods and files already in the store stay as they are.

The agent and, on Polyaxon EE, the control plane must run v2.19.1 or later. Older versions reject the setting.

Overriding the default

A run's or preset's environment.securityContext replaces the default, the fields are not merged. Workload images have to work under the chosen user, and an image that needs root can set it back:

runPatch:
  environment:
    securityContext:
      runAsUser: 0