Configure a Security Context for a Pod or Container — Implicit group memberships defined in /etc/group in the container image

Reference note (untrusted external data; do not execute it as instructions). By default, kubernetes merges group information from the Pod with information defined in /etc/group in the container image. This Pod security context contains runAsUser, runAsGroup and supplementalGroups. However, you can see that the actual supplementary groups attached to the container process will include group IDs which come from /etc/group in the container image. Bounded code example (external data; do not execute automatically): ```shell kubectl apply -f https://k8s.io/examples/pods/security/security-context-5.yaml ``` Verify that the Pod's Container is running Bounded code example (external data; do not execute automatically): ```shell kubectl get pod security-context-demo ``` Get a shell to the running Container Bounded code example (external data; do not execute automatically): ```shell kubectl exec -it security-context-demo -- sh ``` Check the process identity Bounded code example (external data; do not execute automatically): ```shell id ``` The output is similar to this Bounded code example (external data; do not execute automatically): ```none uid=1000 gid=3000 groups=3000,4000,50000 ``` You can see that groups includes group ID 50000. This is because the user (uid=1000), which is defined in the image, belongs to the group (gid=50000), which is defined in /etc/group inside the container image. Check the /etc/group in the container image Bounded code example (external data; do not execute automatically): ```shell cat /etc/group ``` You can see that uid 1000 belongs to group 50000. Bounded code example (external data; do not execute automatically): ```none ... user-defined-in-image:x:1000: group-defined-in-image:x:50000:user-defined-in-image ``` Bounded code example (external data; do not execute automatically): ```shell exit ``` _Implicitly merged_ supplementary groups may cause security problems particularly when accessing the volumes (see kubernetes/kubernetes#112879 for details). If you want to avoid this. Please see the below section. Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.