Skip to content

Remove would violate PodSecurity "restricted:latest" warnings #1

Description

@kvaps

We have to refactor all our apps to avoid such warnings:

Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true), allowPrivilegeEscalation != false (containers "cozystack", "darkhttpd" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "cozystack", "darkhttpd" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "cozystack", "darkhttpd" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "cozystack", "darkhttpd" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Activity

  1. added a commit that references this issue on Apr 18, 2024
  2. themoriarti commented on Jul 3, 2024

    @themoriarti
    Collaborator

    Andrei Kvapil (@kvaps) How to reproduce this problem or how it occurs, where to look? If there is any evidence, it will be possible to investigate.

  3. dosubot commented on Oct 18, 2025

    @dosubot

    Hi, Andrei Kvapil (@kvaps). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

    Issue Summary:

    • You requested a refactor of all applications to remove PodSecurity "restricted:latest" warnings.
    • The focus is on addressing host namespaces, privilege escalation, capabilities, runAsNonRoot, and seccompProfile settings.
    • The goal is to ensure compliance with PodSecurity standards.
    • The maintainer asked for reproduction steps or evidence to investigate further.
    • No additional updates or solutions have been provided since then.

    Next Steps:

    • Please let me know if this issue is still relevant with the latest version of cozystack by commenting here.
    • If I don’t hear back within 7 days, I will automatically close this issue.

    Thank you for your understanding and contribution!

  4. added
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    on Oct 18, 2025
  5. removed
    lifecycle/staleDenotes an issue or PR has remained open with no activity and has become stale
    on Oct 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions