<p>I can't seem to understand why the below mentioned pod manifest isn't working if I remove spec.containers.command, the pod fails if I remove the command.</p>
<p>I took this example from the official <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">documentation</a></p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ &quot;sh&quot;, &quot;-c&quot;, &quot;sleep 1h&quot; ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false
</code></pre>

Viplove
<p>Because the <code>busybox</code> image doesn't run any process at start by itself. Containers are designed to run single application and shutdown when the app exits. If the image doesn't run anything it will immediately exit. In the Kubernetes the <code>spec.containers.command</code> overwrites the default container command. You can try changing the manifest image for i.e. <code>image: nginx</code>, remove the <code>spec.containers.command</code> and it will run, because that image as default Nginx server.</p>
