<p>In my POD, I wanted to restrict ALL my containers to read-only file systems with
<em><strong>securityContext: readOnlyRootFilesystem: true</strong></em><br />
example (note: yaml reduced for brevity)</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:      
  labels:
    run: server123
  name: server123
spec:
  securityContext:
    readOnlyRootFilesystem: true
  containers:
  - image: server1-image
    name: server1 
  - image: server2-image
    name: server2
  - image: server3-image
    name: server3
</code></pre>
<p>this will result in:</p>
<blockquote>
<p>error: error validating &quot;server123.yaml&quot;: error validating data:
ValidationError(Pod.spec.securityContext): unknown field
&quot;readOnlyRootFilesystem&quot; in io.k8s.api.core.v1.PodSecurityContext; if
you choose to ignore these errors, turn validation off with
--validate=false</p>
</blockquote>
<p>instead I have to configure as:</p>
<pre><code>apiVersion: v1
    kind: Pod
    metadata:      
      labels:
        run: server123
      name: server123
    spec:
      containers:
      - image: server1-image
        name: server1
        securityContext:
          readOnlyRootFilesystem: true 
      - image: server2-image
        name: server2
        securityContext:
          readOnlyRootFilesystem: true
      - image: server3-image
        name: server3
        securityContext:
          readOnlyRootFilesystem: true
</code></pre>
<p>Is there a way to set this security restriction ONCE for all containers?
If not why not?</p>

<p>In Kubernetes, can configure <em><strong>securityContext</strong></em> at pod and/or container level,
containers would inherit pod-level settings, but can override in their own.</p>
<p>The configuration options for pods and containers do not, however, overlap - you can only set specific ones at each level,<br />
Container level: <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core" rel="noreferrer">https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core</a><br />
Pod level: <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core" rel="noreferrer">https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core</a></p>
<p>Its not documented clearly what can be inherited and what cannot (and why!). You have to read through both lists and compare.
I would assume that POD's securityContext would allow, say, <em><strong>readOnlyRootFilesystem: true</strong></em> and various <em><strong>capabilities</strong></em>, to be set once and not have to be replicated in each underlying container's securityContext, but <strong>PodSecurityContext</strong> does not allow this!</p>
<p>Would be particularly useful when (re)configuring various workloads to adhere to PodSecurityPolicies.</p>
<p>I wonder why a Pod's <em><strong>securityContext</strong></em> configuration is labelled as such, and not instead as <em><strong>podSecurityContext</strong></em>, which is what it actually represents.</p>
