CKAD Practice Question 7: SecurityContext Nonroot Readonly
Certified Kubernetes Application Developer (CKAD) · Test 1 · question 7 of 10
A security review requires that a workload's container process must not run as root, must not be able to gain additional privileges through setuid binaries, and must not be able to write to its own image filesystem. The image was built with USER root and cannot be rebuilt before the deadline, but the application itself only writes to a mounted emptyDir.
Which container securityContext satisfies all three requirements?
Show answer and explanation
Answer:
Each requirement maps to one field. runAsUser: 1000 overrides the image's USER root at runtime, so no rebuild is needed; runAsNonRoot: true is the belt-and-braces check that makes the kubelet refuse to start the container if it would ever resolve to UID 0. allowPrivilegeEscalation: false sets the no_new_privs flag so setuid binaries cannot raise privileges. readOnlyRootFilesystem: true mounts the image filesystem read-only, which is safe here because the writable paths are on an emptyDir volume.
Option A is a common misreading. runAsNonRoot: true is a validation, not an assignment; it causes the container to fail to start if the effective UID is 0, but it never picks a UID. With this image the Pod would simply error out, and nothing addresses the filesystem requirement.
Option B contradicts the first requirement outright: runAsUser: 0 *is* root inside the container. Container root is more constrained than host root, but it is still the thing the review prohibits.
Option D changes neither the UID nor the filesystem. privileged: false is already the default, and dropping capabilities reduces what root can do without stopping the process from being root or preventing privilege escalation via setuid.
Reference: Configure a Security Context for a Pod or Container