apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
  annotations:
    seccomp.security.alpha.kubernetes.io/pod: "runtime/default"
spec:  
  securityContext:
    runAsUser: 1000    
    runAsGroup: 3000
    fsGroup: 2000
    supplementalGroups: [ 1 ]    
  volumes:
   - name: unapproved-volume
     hostPath:
      path: /var/log/pods
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]        
    volumeMounts:
    - name: unapproved-volume
      mountPath: /data/demo
      
    securityContext:
      allowPrivilegeEscalation: false            