784 B
784 B
SecurityContext placement retrieval
The learner completed Lesson 33 and explicitly preferred its manifest-hardening format. The final static manifest correctly separates Pod-wide identity and seccomp settings from container-level privilege escalation, capabilities, and read-only-root controls. It also confines the sidecar's writable state to an emptyDir mount.
Coaching adjustment
Increase subsequent work to original, timed, multi-control tasks aligned with the public CKS curriculum or harder. Preserve exam-style brevity, require verification evidence, and continue listing all issues while correcting one per review round.
Evidence limitation
The manifest passed static review. Runtime rollout and filesystem verification were not observed in the teaching shell.