apiVersion: v1
kind: Pod
metadata:
    name: security-context-demo
spec:
    securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
    volumes:
        - name: sec-ctx-vol
          emptyDir: {}
    containers:
        - name: sec-ctx-demo-ctr
          image: busybox
          command: ["sh", "-c", "sleep 1h"]
          volumeMounts:
              - name: sec-ctx-vol
                mountPath: /data/demo
          securityContext:
              allowPrivilegeEscalation: false
