apiVersion: v1
kind: Namespace
metadata:
  name: payments-prod
---
apiVersion: v1
kind: Pod
metadata:
  name: payments
  namespace: payments-prod
  labels:
    app: payments
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 101
    seccompProfile:
      type: RuntimeDefault
  volumes:
    - name: secure-tmp
      emptyDir: {}
  containers:
    - name: payments
      image: nginxinc/nginx-unprivileged:1.27
      volumeMounts:
      - name: secure-tmp
        mountPath: /tmp
      ports:
        - containerPort: 8080
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true

        capabilities: 
          drop: ["ALL"]