apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    env: test
spec:
  containers:
  - name: nginx
    image: nginx
    securityContext:
      capabilities:
        drop:
          - net_admin
          - ChOwN
          - DaC_OverriDE
          - fsetid
          - FOWNER
          - MKNOD
          - NET_RAW
          - SETGID
          - SETUID
          - SETFCAP
          - SETPCAP
          - NET_BIND_SERVICE
          - SYS_CHROOT
          - KILL
          - AUDIT_WRITE

