instruction: Create a Dockerfile for security
output: ```dockerfile
  from the Baseline policyVolume TypesThe Restricted policy only permits the following volume types.Restricted Fieldsspec.volumes[*]Allowed ValuesEvery item in the spec.volumes[*] list must set one of the following fields to a non- value:spec.volumes[*].configMapspec.volumes[*].csispec.volumes[*].downwardAPIspec.volumes[*].emptyDirspec.volumes[*].ephemeralspec.volumes[*].persistentVolumeClaimspec.volumes[*].projectedspec.volumes[*].secretPrivilege Escalation (v1.8+)Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. This is Linux only policy in v1.25+ (spec.os.name != windows)Restricted Fieldsspec.containers[*].securityContext.allowPrivilegeEscalationspec.initContainers[*].securityContext.allowPrivilegeEscalationspec.ephemeralContainers[*].securityContext.allowPrivilegeEscalationAllowed ValuesfalseRunning as Non-rootContainers must be required to run as non-root users.Restricted Fieldsspec.securityContext.runAsNonRootspec.containers[*].securityContext.runAsNonRootspec.initContainers[*].securityContext.runAsNonRootspec.ephemeralContainers[*].securityContext.runAsNonRootAllowed ValuestrueThe container fields may be /nil if the pod-level
  spec.securityContext.runAsNonRoot is set to true.Running as Non-root user (v1.23+)Containers must not set runAsUser to 0Restricted Fieldsspec.securityContext.runAsUserspec.containers[*].securityContext.runAsUserspec.initContainers[*].securityContext.runAsUserspec.ephemeralContainers[*].securityContext.runAsUserAllowed Valuesany non-zero value/Seccomp (v1.19+)Seccomp profile must be explicitly set to one of the allowed values. Both the Unconfined profile and the absence of a profile are prohibited. This is Linux only policy in v1.25+ (spec.os.name != windows)Restricted Fieldsspec.securityContext.seccompProfile.typespec.containers[*].securityContext.seccompProfile.typespec.initContainers[*].securityContext.seccompProfile.typespec.ephemeralContainers[*].securityContext.seccompProfile.typeAllowed ValuesRuntimeDefaultLocalhostThe container fields may be /nil if the pod-level
  spec.securityContext.seccompProfile.type field is set appropriately.
  Conversely, the pod-level field may be /nil if _all_ container-
  level fields are set.Capabilities (v1.22+)Containers must drop ALL capabilities, and are only permitted to add back
  the NET_BIND_SERVICE capability. This is Linux only policy in v1.25+ (.spec.os.name != "windows")Restricted Fieldsspec.containers[*].securityContext.capabilities.dropspec.initContainers[*].securityContext.capabilities.dropspec.ephemeralContainers[*].securityContext.capabilities.dropAllowed ValuesAny list of capabilities that includes ALLRestricted Fieldsspec.containers[*].securityContext.capabilities.addspec.initContainers[*].securityContext.capabilities.addspec.ephemeralContainers[*].securityContext.capabilities.addAllowed Values/nilNET_BIND_SERVICEPolicy InstantiationDecoupling policy definition
  ```