fix(execute): avoid privilege escalation in Kubernetes jobs (#475)

Configure the security context of Kubernetes jobs to disallow privilege escalation.
reanahub · Nov 22, 2024 · 41e6d1f · 41e6d1f
1 parent e3218dc
commit 41e6d1f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/reana_job_controller/kubernetes_job_manager.py b/reana_job_controller/kubernetes_job_manager.py
@@ -1,5 +1,5 @@
 # This file is part of REANA.
-# Copyright (C) 2019, 2020, 2021, 2022, 2023 CERN.
+# Copyright (C) 2019, 2020, 2021, 2022, 2023, 2024 CERN.
 #
 # REANA is free software; you can redistribute it and/or modify it
 # under the terms of the MIT License; see LICENSE file for more details.
@@ -167,6 +167,7 @@ def execute(self):
                                 "name": "job",
                                 "env": [],
                                 "volumeMounts": [],
+                                "securityContext": {"allowPrivilegeEscalation": False},
                             }
                         ],
                         "initContainers": [],