apiVersion: v1
kind: Pod
metadata:
  name: webserver
  labels:
    app.kubernetes.io/name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:latest
    ports:
    - containerPort: 80
    securityContext:
      runAsUser: 2000
      runAsGroup: 3000
      runAsNonRoot: true
      allowPrivilegeEscalation: false