instruction: Create a Dockerfile for workloads
output: ```dockerfile
  from the optimization.
  This feature gate requires SELinuxMountReadWriteOncePod enabled. It is beta and enabled by default in 1.33.SELinuxMount enables the optimization for all eligible volumes. Since it can break existing workloads, we recommend
  enabling SELinuxChangePolicy feature gate + SELinuxWarningController first to check the impact of the change.
  This feature gate requires SELinuxMountReadWriteOncePod and SELinuxChangePolicy enabled. It is beta, but disabled
  by default in 1.33.Managing access to the /proc filesystemFEATURE STATE:
  Kubernetes v1.33 [beta] (enabled by default: true)For runtimes that follow the OCI runtime specification, containers default to running in a mode where
  there are multiple paths that are both masked and read-only.
  The result of this is the container has these paths present inside the container's mount namespace, and they can function similarly to if
  the container was an isolated host, but the container process cannot write to
  them. The list of masked and read-only paths are as follows:Masked Paths:/proc/asound/proc/acpi/proc/kcore/proc/keys/proc/latency_stats/proc/timer_list/proc/timer_stats/proc/sched_debug/proc/scsi/sys/firmware/sys/devices/virtual/powercapRead-Only Paths:/proc/bus/proc/fs/proc/irq/proc/sys/proc/sysrq-triggerFor some Pods, you might want to bypass that default masking of paths.
  The most common context for wanting this is if you are trying to run containers within
  a Kubernetes container (within a pod).The securityContext field procMount allows a user to request a container's /proc
  be Unmasked, or be mounted as read-write by the container process. This also
  applies to /sys/firmware which is not in /proc....
  securityContext:
   procMount: Unmasked
  Note:Setting procMount to Unmasked requires the spec.hostUsers value in the pod
  spec to be false. In other words: a container that wishes to have an Unmasked
  /proc or unmasked /sys must also be in a
  user namespace.
  Kubernetes v1.12 to v1.29 did not enforce that requirement.DiscussionThe security context for a Pod applies to the Pod's Containers and also to
  the Pod's Volumes when applicable. Specifically fsGroup and seLinuxOptions are
  applied to Volumes as follows:fsGroup: Volumes that support ownership management are modified to be owned
  and writable by the GID specified in fsGroup. See the
  Ownership Management design document
  for more details.seLinuxOptions: Volumes that support SELinux labeling are relabeled to be accessible
  by the label specified under seLinuxOptions. Usually you only
  need to set the level section. This sets the
  Multi-Category Security (MCS)
  label given to all Containers in the Pod as well as the Volumes.Warning:After you specify an MCS label for a Pod, all Pods with the same label can access the Volume.
  If you need inter-Pod protection, you must assign a unique MCS label to each Pod.Clean upDelete the Pod:kubectl delete pod security-context-demo
  kubectl delete pod security-context-demo-2
  kubectl delete pod security-context-demo-3
  kubectl delete pod security-context-demo-4
  What's nextPodSecurityContextSecurityContextCRI Plugin Config GuideSecurity Contexts design documentOwnership Management design documentPodSecurity AdmissionAllowPrivilegeEscalation design
  documentFor more information about security mechanisms in Linux, see
  Overview of Linux Kernel Security Features
  (Note: Some information is out of date)Read about User Namespaces
  for Linux pods.Masked Paths in the OCI Runtime
  SpecificationItems on this page refer to third party products or projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. See the CNCF website guidelines for more details.You should read the content guide before proposing a change that adds an extra third-party link.FeedbackWas this page helpful?Yes
  NoThanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  Stack Overflow.
  Open an issue in the GitHub Repository if you want to
  report a problem
  or
  suggest an improvement.Last modified July 10, 2025 at 12:11 PM PST: Fix typo: identitiy ➔ identity in security context docs (feea375c99)  Create child page
   Create an issue
   Print entire sectionBefore you beginSet the security context for a PodImplicit group memberships defined in /etc/group in the container imageConfigure fine-grained SupplementalGroups control for a PodImplementationsConfigure volume permission and ownership change policy for PodsDelegating volume permission and ownership change to CSI driverSet the security context for a ContainerSet capabilities for a ContainerSet the Seccomp Profile for a ContainerSet the AppArmor Profile for a ContainerAssign SELinux labels to a ContainerEfficient SELinux volume relabelingManaging access to the /proc filesystemDiscussionClean upWhat's next© 2025 The Kubernetes Authors | Documentation Distributed under CC BY 4.0© 2025 The Linux Foundation ®. ```