<p>I have pod level security context like in below snippet:</p>

<pre><code>spec:
  securityContext:
    runAsUser: 1010
    runAsGroup: 1010
    fsGroup: 1010
  containers:
       --------
       -------
</code></pre>

<p>one of my container need root privileges so I added one more securityContext as below:</p>

<pre><code>   spec:
      securityContext:
        runAsUser: 1010
        runAsGroup: 1010
        fsGroup: 1010
      containers:
      - name: sample
        securityContext:
          runAsUser: 0
        image: sampleimage
        ----------------
        -----------------
</code></pre>

<p>Now my container is able to run with root privileges but my requirement is rather than making <strong>runAsUser: 0</strong> which is root! Is there any other way we can escalate privileges for container alone using same <strong>runAsUser: 1010</strong>  ?</p>

<p>I found some options like <strong>allowPrivilegeEscalation:</strong> true &amp; <strong>capabilities:</strong> but no luck! maybe am using it in wrong way.</p>

<pre><code>containers:
- image: sampleimage
  name: sample
  securityContext:
    allowPrivilegeEscalation: true
</code></pre>

<p>AND</p>

<pre><code>  containers:
  - image: sampleimage
    name: sample
    securityContext:
      capabilities:
        add: ["SYS_ADMIN"]
</code></pre>

<p>Can anyone help by correcting my code or help with an example to refer to and implement? Please.</p>

sudhir tataraju
<p>You need to specify the appropriate capabilities for the action you want to permit for the container. </p>

<p>As described in the 
<a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities" rel="nofollow noreferrer">kubernetes official documentation</a></p>

<p>There are 7 capabilities that you can choose from <a href="http://man7.org/linux/man-pages/man7/capabilities.7.html" rel="nofollow noreferrer">linux documentation</a></p>

<p>And everything comes down to what privileges you want to grant to the specific user.</p>

<blockquote>
  <p>Example</p>
</blockquote>

<p>Confirm that you pass the correct configuration by running the following commands</p>

<p><code>kubectl exec pod -c container whoami</code></p>

<p><code>kubectl exec -it pod -c container -- date -s '10 APR 2020 10:10:10'</code></p>

<p>With the second command if you specified something wrong you will receive the error</p>

<p>date: cannot set date: Operation not permitted</p>

<p>Now if you add the Capability SYS_TIME</p>

<pre><code>  containers:
  - image: yourimage
    name: yourimagename
    securityContext:
      runAsUser: 1010
      capabilities:
        add: ["SYS_TIME"]
</code></pre>

<p>Execute the second command again and you will see the date reflected as string.</p>
