Fix BuildKit rootless: allow privilege escalation for newuidmap/newgidmap

2026-04-26 01:17:41 -05:00
parent d8e2a9601b
commit e138c45d51
1 changed files with 2 additions and 1 deletions
@@ -35,9 +35,10 @@ spec:
              containerPort: 1234
          securityContext:
            seccompProfile:
-              type: Unconfined       # BuildKit rootless requires this
+              type: Unconfined            # BuildKit rootless requires this
            runAsUser: 1000
            runAsGroup: 1000
+            allowPrivilegeEscalation: true  # required for newuidmap/newgidmap setuid binaries
          readinessProbe:
            exec:
              command: ["buildctl", "debug", "workers"]