How to: Security context
> This section requires a basic understanding of unix-based systems file permissions and access control covered in [ch2 - container access control](#docker-container-access-control)

A [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) defines privilege and access control settings for a Pod or Container. Security context can be controlled at Pod-level `pod.spec.securityContext` as well as at container-level `pod.spec.containers.securityContext`. A detailed explanation of security context is provided in the linked docs, however, for [CKAD](https://www.cncf.io/certification/ckad/), we will only focus on the following:

- `runAsGroup: $GID` - specifies the GID of logged-in user in pod containers (pod and container level)
- `runAsNonRoot: $boolean` - specifies whether the containers run as a non-root user at image level - containers will not start if set to `true` while image uses root (pod and container)
- `runAsUser: $UID` - specifies the UID of logged-in user in pod containers (pod and container)
- `fsGroup: $GID` - specifies additional GID used for filesystem (mounted volumes) in pod containers (pod level)
- `privileged: $boolean` - controls whether containers will run as privileged or unprivileged (container level)
- `allowPrivilegeEscalation: $boolean` - controls whether a process can gain more privileges than its parent process - always `true` when the container is run as privileged, or has `CAP_SYS_ADMIN` (container level)
- `readOnlyRootFilesystem: $boolean` - controls whether the container has a read-only root filesystem (container level)

>

```sh