# docker run -it --net host --pid host --userns host --cap-add audit_control \
#     -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
#     -v /etc:/etc:ro \
#     -v /lib/systemd/system:/lib/systemd/system:ro \
#     -v /usr/bin/containerd:/usr/bin/containerd:ro \
#     -v /usr/bin/runc:/usr/bin/runc:ro \
#     -v /usr/lib/systemd:/usr/lib/systemd:ro \
#     -v /var/lib:/var/lib:ro \
#     -v /var/run/docker.sock:/var/run/docker.sock:ro \
#     --label docker_bench_security \
#     docker/docker-bench-security
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: docker-bench-security
  labels:
    name: docker-bench
spec:
  selector:
    matchLabels:
      name: docker-bench
  template:
    metadata:
      labels:
        name: docker-bench
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      securityContext:
        runAsUser: 0
      containers:
        - name: docker-bench
          image: madhuakula/hacker-container
          imagePullPolicy: Always
          command: ["/bin/sh", "-c", "sleep infinity"]
          resources:
            requests:
              cpu: 20m
              memory: 50Mi
            limits:
              cpu: 50m
              memory: 80Mi
          securityContext:
            privileged: true
            capabilities:
              add: ["AUDIT_CONTROL"]
          volumeMounts:
            - name: var-lib-vol
              mountPath: /var/lib
              readOnly: true
            - name: usr-lib-systemd-vol
              mountPath: /usr/lib/systemd
              readOnly: true
            - name: etc-vol
              mountPath: /etc
              readOnly: true
            - name: lib-systemd-system-vol
              mountPath: /lib/systemd/system
              readOnly: true
            - name: usr-bin-contained-vol
              mountPath: /usr/bin/containerd
              readOnly: true
            - name: usr-bin-runc-vol
              mountPath: /usr/bin/runc
              readOnly: true
            - name: docker-sock-volume
              mountPath: /var/run/docker.sock
              readOnly: true
      volumes:
        - name: var-lib-vol
          hostPath:
            path: /var/lib
        - name: usr-lib-systemd-vol
          hostPath:
            path: /usr/lib/systemd
        - name: etc-vol
          hostPath:
            path: /etc
        - name: lib-systemd-system-vol
          hostPath:
              path: /lib/systemd/system
        - name: usr-bin-contained-vol
          hostPath:
              path: /usr/bin/containerd
        - name: usr-bin-runc-vol
          hostPath:
              path: /usr/bin/runc
        - name: docker-sock-volume
          hostPath:
            path: /var/run/docker.sock
            type: Socket
