fix(security): drop SYS_ADMIN from video editor

The published service disables the Chromium sandbox and does not perform system administration operations, so the broad capability is unnecessary. Drop all capabilities, prevent privilege escalation, and use the runtime default seccomp profile.
2026-07-23 11:12:03 +08:00
parent c416a46b4c
commit 024f9267a9
2 changed files with 6 additions and 3 deletions
@@ -70,9 +70,12 @@ spec:
              cpu: "2"
              memory: 4Gi
          securityContext:
+            allowPrivilegeEscalation: false
            capabilities:
-              add:
-                - SYS_ADMIN
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
      volumes:
        - name: temp
          emptyDir: {}