apiVersion: v1
kind: Pod
metadata:
  name: safe
  namespace: restricted
spec:
  volumes:
  - name: data
    emptyDir: {}
  initContainers:
  - name: init
    image: alpine:3
    volumeMounts:
    - name: data
      mountPath: /data
    args:
    - /bin/sh
    - -c
    - mkdir /data/nginx; chown -R 1000 /data
  containers:
  - name: app
    image: nginx
    resources: {}
    ports:
      - containerPort: 80
    volumeMounts:
    - name: data
      mountPath: /var/cache
    - name: data
      mountPath: /run
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      allowPrivilegeEscalation: false
      seccompProfile:
        type: RuntimeDefault
      capabilities:
        drop:
        - ALL
        add:
        - BIND_SERVICE