apiVersion: v1
kind: Pod
metadata:
  name: demo
  namespace: restricted
spec:
  containers:
  - name: demo
    image: ghcr.io/trion-development/echoserver:1
    resources: {}
    ports:
      - containerPort: 3000
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
      capabilities:
        drop: ["ALL"]