Overview

By default, Polyaxon operations run without a security context, and pods run as root.

Usage

If you need to configure a security context for your jobs and services, you can use the environment.securityContext section:

kind: component
...
run:
  kind: ...
  environment:
    securityContext:
      runAsUser: 1000
      runAsGroup: 3000
      fsGroup: 2000

If you are running a distributed operation, you can provide a security context per replica as well.

Container-only settings

environment.securityContext is the Pod security context, it applies to all containers of the Pod. Settings that only exist on containers, such as privileged, capabilities, allowPrivilegeEscalation and readOnlyRootFilesystem, go in the container's securityContext, see the Kubernetes docs:

kind: component
...
run:
  kind: job
  container:
    image: quay.io/buildah/stable:latest
    securityContext:
      privileged: true

Global configuration

If you want to define a security context globally, we suggest creating a preset. If you are using Polyaxon Cloud or Polyaxon EE, you can add the security context definition to the default organization's preset or the default project's preset.