MSSQL Container Conflict with PSS Enforcement on RedHat OpenShift

[RufusJWB]

Our penetration test team has requested that we enforce the “Restricted” PSS policy by adding the following labels to the namespace:

pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: 1.24

One requirement of the “Restricted” policy is setting allowPrivilegeEscalation to false. However, our MSSQL container image fails to run under this configuration and raises the following error:

SQL Server 2022 will run as non-root by default.
This container is running as user 1003350000.
Your master database file is owned by 1003350000.
To learn more visit https://go.microsoft.com/fwlink/?linkid=2099216.
/opt/mssql/bin/permissions_check.sh: line 60: /opt/mssql/bin/sqlservr: Operation not permitted
/opt/mssql/bin/permissions_check.sh: line 60: /opt/mssql/bin/sqlservr: Success

Below is the relevant patch we applied to our StatefulSet:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mssql
spec:
  template:
    spec:
      serviceAccountName: mssql-ref
      securityContext:
        runAsUser: 1003350000
        fsGroup: 1003350000
      containers:
        - name: sql-exporter
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
        - name: mssql
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault

We also assigned the microsoft-sql-server SCC to the mssql-ref service account, but this did not resolve the issue. According to Microsoft’s documentation (bdc-scc.yaml example) MSSQL requires allowPrivilegeEscalation to be set to true, and overriding these settings would break core functionality.

Is there any way to enforce the “Restricted” PSS policy?