Make a Container Immutable

medium 20 XP ~9 minHands-on lab

barcode in checkout runs nginxinc/nginx-unprivileged:1.27-alpine with the container defaults. Someone who breaks into it could change its files, for example drop a backdoor into /etc/nginx.

Task

The container's root filesystem is read-only.
It must run as non-root, as UID 10001, without privilege escalation, with all capabilities dropped.
The app still needs to write to /tmp (its PID file) and /var/cache/nginx. Give it an emptyDir volume for each, and nothing else writable.
Both replicas keep running.

If a Pod crashes, kubectl logs tells you which path it couldn't write.

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

cks securitycontext immutability runtime-security