run as non root by default

knative · Sep 13, 2023 · 11c7925 · 11c7925
1 parent a072003
commit 11c7925
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/pkg/apis/serving/v1/revision_defaults.go b/pkg/apis/serving/v1/revision_defaults.go
@@ -208,6 +208,8 @@ func (rs *RevisionSpec) defaultSecurityContext(psc *corev1.PodSecurityContext, c
 		}
 	}
 
+	updatedSC.RunAsNonRoot = ptr.Bool(true)
+
 	if *updatedSC != (corev1.SecurityContext{}) {
 		container.SecurityContext = updatedSC
 	}