fix(hermes): run triage gateway as nonroot

2026-08-08 19:01:14 -03:00 · 2026-08-08 19:01:14 -03:00 · 753de55c94
commit 753de55c94
parent c7075c0172
1 changed files with 9 additions and 0 deletions
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@ -292,6 +292,15 @@ spec:
            # TODO: migrate to Vault alongside the Gitea token; this manual
            # Secret was created in the interest of demo time.

+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            capabilities:
+              drop: [ALL]
+            seccompProfile:
+              type: RuntimeDefault
          volumeMounts:
            - name: home
              mountPath: /opt/data