<p>If we want to to build OCI container images with <code>docker</code>
and e.g. want to the following pod setup:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: dind
spec:
  containers:
    - name: build
      image: docker:23.0.1-cli
      command:
        - cat
      tty: true
      resources:
        requests:
          cpu: 10m
          memory: 256Mi
      env:
        - name: DOCKER_HOST
          value: tcp://localhost:2375

    - name: dind-daemon
      image: docker:23.0.1-dind-rootless
      securityContext:
        privileged: true
      resources:
        requests:
          cpu: 20m
          memory: 512Mi
      volumeMounts:
        - name: docker-graph-storage
          mountPath: /var/lib/docker
  volumes:
    - name: docker-graph-storage
      emptyDir: {}
</code></pre>
<p>I am wondering what the replacement is for</p>
<pre class="lang-yaml prettyprint-override"><code>securityContext:
        privileged: true
</code></pre>
<p>since that is deprecated in  <code>kubernetes &gt;1.25</code> because: <a href="https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/" rel="nofollow noreferrer">https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/</a></p>
<p>and if its still possible to do the same as above and how?</p>

Gabriel
<p>As per kubernetes official API reference documentation for V 1.26 they have changed the fields for security context.</p>
<p>Instead of using <code>privileged: true</code> they got other parameters  in the latest versions. That are</p>
<p><strong>runAsUser:</strong> You can run as any user  in the latest versions by using the UID of the user if your image has that user. In general the UID for root users is 0, so you can mention the UID of root user in the yaml file while creating the deployment.</p>
<p><strong>allowPrivilegeEscalation:</strong>  If allowPrivilegeEscalation is set to true privileges will be escalated to the root user when required.</p>
<p><strong>runAsNonRoot:</strong>  If <code>runAsNonRoot</code> is set to true a validation will be performed and kubernetes will stop the pod or container from starting else if it’s unset or set to false it won’t prevent root execution, provided your image is built to run as root.</p>
<p>Both <code>runAsUser</code> and <code>runAsNonRoot</code> can be used if you want to execute the job or task continuously as root whereas <code>allowPrivilegeEscalation</code> can be used for temporarily escalating privileges. Below is the yaml example file for the latest version, use it as a reference</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
 name: security-context-demo

spec:
 securityContext:
   runAsUser: 1000
   runAsGroup: 3000
   fsGroup: 2000

 volumes:
 - name: sec-ctx-vol
   emptyDir: {}

 containers:
 - name: sec-ctx-demo
   image: busybox:1.28
   command: [ &quot;sh&quot;, &quot;-c&quot;, &quot;sleep 1h&quot; ]

   volumeMounts:
   - name: sec-ctx-vol
     mountPath: /data/demo

   securityContext:
     allowPrivilegeEscalation: false
</code></pre>
<p>Note: The yaml code and the above explanation is derived from official kubernetes documentation.</p>
<p>[1]<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/security-context/</a>
[2]<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#podsecuritycontext-v1-core" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#podsecuritycontext-v1-core</a></p>
