demo-app: numeric uid + /tmp emptyDir (runAsNonRoot ke liye)

manifests/demo-app/deployment.yaml

@@ -21,6 +21,11 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # Dockerfile me USER appuser hai; k8s naam se verify nahi kar sakta,
+        # isliye numeric uid dena zaroori hai.
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -34,6 +39,10 @@ spec:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
+          volumeMounts:
+            # rootfs read-only hai, par gunicorn ko likhne ki jagah chahiye
+            - name: tmp
+              mountPath: /tmp
           resources:
             requests: { cpu: "50m",  memory: "64Mi" }
             limits:   { cpu: "500m", memory: "256Mi" }
@@ -45,3 +54,6 @@ spec:
             httpGet: { path: /health, port: 8000 }
             initialDelaySeconds: 15
             periodSeconds: 20
+      volumes:
+        - name: tmp
+          emptyDir: {}