apiVersion: v1
kind: Pod
metadata:
  name: buildctl
  annotations:
    container.apparmor.security.beta.kubernetes.io/buildctl: unconfined
    container.seccomp.security.alpha.kubernetes.io/buildctl: unconfined
spec:
  containers:
  - name: buildctl
    image: moby/buildkit:master-rootless
    command: ["tail", "-f", "/dev/null"]
    imagePullPolicy: Always
    securityContext:
      runAsUser: 1000
      runAsGroup: 1000
