Lesson 0006 · 25 minutes · Minimize Microservice Vulnerabilities

Harden a web workload without breaking its writable paths

A read-only root filesystem limits post-compromise persistence, but applications still need deliberate places for transient state. This drill builds that boundary.

Exam reflex: when you set readOnlyRootFilesystem: true, identify every path the process must write to and mount only those paths as temporary writable volumes.

Timed task: 15 minutes

In namespace payments-prod, harden the payments Pod while keeping it available on port 8080. Begin with kubectl --context kind-cks-lab apply -f .\lab\payments-hardening-starter.yaml and write the completed manifest to lab/payments-hardening-answer.yaml.

Preserve the Pod name, namespace, image, label, and container port. Add the following controls:

Run as non-root UID 101.
Set allowPrivilegeEscalation: false.
Drop all Linux capabilities.
Use the RuntimeDefault seccomp profile.
Set readOnlyRootFilesystem: true.
Mount one writable emptyDir volume at /tmp.

This uses the unprivileged NGINX image, which listens on 8080. A non-root process that has dropped all capabilities cannot generally bind port 80; changing the port is the correct secure design rather than adding NET_BIND_SERVICE.

Proof, not assumption

kubectl --context kind-cks-lab apply -f .\lab\payments-hardening-answer.yaml
kubectl --context kind-cks-lab -n payments-prod wait --for=condition=Ready pod/payments --timeout=60s
kubectl --context kind-cks-lab -n payments-prod exec payments -- id
kubectl --context kind-cks-lab -n payments-prod exec payments -- sh -c 'touch /tmp/ok && test -f /tmp/ok'
kubectl --context kind-cks-lab -n payments-prod exec payments -- sh -c 'touch /root/nope'

The identity must have a non-zero UID, the /tmp check must succeed, and the final command must fail with a read-only filesystem error.

Retrieval check

Question

Why is an emptyDir volume usually preferable to leaving the image filesystem writable for runtime scratch data?

It limits writes to an explicit, ephemeral path while keeping the image filesystem immutable.It makes all application writes faster.It preserves the data across Pod replacement.

Documentation target

Use the official Configure a Security Context for a Pod or Container guide to confirm security-context placement and volume-mount syntax.

What to send me

Paste your answer YAML and the three proof outputs. I’ll check the writable boundary and show you a fast inspection command.