# https://github.com/open-policy-agent/gatekeeper/blob/master/library/pod-security-policy/privileged-containers/example.yaml
apiVersion: v1
kind: Pod
metadata:
  name: root-demo-privileged
spec:
  securityContext:
    runAsUser: 0
    runAsGroup: 0
  containers:
  - name:  root-demo
    image:  pinpindock/rootdemo-alpine:dev
    command: ['sh', '-c', 'while true;do date;echo hello;sleep 10;done']
    resources:
      requests:
        memory: "12Mi"
        cpu: "100m"
      limits:
        memory: "20Mi"
        cpu: "100m"
    ports:
    - containerPort: 80
    volumeMounts:
    - name: workdir
      mountPath: /tmp/
    securityContext:
      privileged: true
      # allowPrivilegeEscalation should available in July
      # allowPrivilegeEscalation: true        
  volumes:
  - name: workdir
    emptyDir: {}