From a9684c384768c83e42c9ecc8124141686f7d488d Mon Sep 17 00:00:00 2001
From: devops <devops@local>
Date: Wed, 16 Sep 2026 16:11:46 +0000
Subject: [PATCH] demo-app: numeric uid + /tmp emptyDir (runAsNonRoot ke liye)

---
 manifests/demo-app/deployment.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/manifests/demo-app/deployment.yaml b/manifests/demo-app/deployment.yaml
index 634dfb2..9a90a4f 100644
--- a/manifests/demo-app/deployment.yaml
+++ b/manifests/demo-app/deployment.yaml
@@ -21,6 +21,11 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        # Dockerfile me USER appuser hai; k8s naam se verify nahi kar sakta,
+        # isliye numeric uid dena zaroori hai.
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -34,6 +39,10 @@ spec:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
+          volumeMounts:
+            # rootfs read-only hai, par gunicorn ko likhne ki jagah chahiye
+            - name: tmp
+              mountPath: /tmp
           resources:
             requests: { cpu: "50m",  memory: "64Mi" }
             limits:   { cpu: "500m", memory: "256Mi" }
@@ -45,3 +54,6 @@ spec:
             httpGet: { path: /health, port: 8000 }
             initialDelaySeconds: 15
             periodSeconds: 20
+      volumes:
+        - name: tmp
+          emptyDir: {}