By default, containers are allowed to make modification to files. This unnecessary privilege increases the cluster attack surface as commonly containers do not need a writable filesystem.

Remediation

The following example makes the root file system read only.

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: app
        securityContext:
          readOnlyRootFilesystem: true