instruction: Create a Dockerfile for workloads
output: ```dockerfile
  from
  those pods to be denied. This policy has no effect on isolation for ingress to any pod.
  Default deny all ingress and all egress traffic
  You can create a "default" policy for a namespace which prevents all ingress AND egress traffic by
  creating the following NetworkPolicy in that namespace.
  
  service/networking/network-policy-default-deny-all.yaml
  
  ---
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
   name: default-deny-all
  spec:
   podSelector: {}
   policyTypes:
   - Ingress
   - Egress
  
  This ensures that even pods that aren't selected by any other NetworkPolicy will not be allowed
  ingress or egress traffic.
  Network traffic filtering
  NetworkPolicy is defined for layer 4
  connections (TCP, UDP, and optionally SCTP). For all the other protocols, the behaviour may vary
  across network plugins.
  Note:You must be using a CNI plugin that supports SCTP
  protocol NetworkPolicies.
  When a deny all network policy is defined, it is only guaranteed to deny TCP, UDP and SCTP
  connections. For other protocols, such as ARP or ICMP, the behaviour is .
  The same applies to allow rules: when a specific pod is allowed as ingress source or egress destination,
  it is  what happens with (for example) ICMP packets. Protocols such as ICMP may be allowed by some
  network plugins and denied by others.
  Targeting a range of ports
  
  FEATURE STATE:
  Kubernetes v1.25 [stable]
  
  When writing a NetworkPolicy, you can target a range of ports instead of a single port.
  This is achievable with the usage of the endPort field, as the following example:
  
  service/networking/networkpolicy-multiport-egress.yaml
  
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
   name: multi-port-egress
   namespace: default
  spec:
   podSelector:
   matchLabels:
   role: db
   policyTypes:
   - Egress
   egress:
   - to:
   - ipBlock:
   cidr: 10.0.0.0/24
   ports:
   - protocol: TCP
   port: 32000
   endPort: 32768
  
  The above rule allows any Pod with label role=db on the namespace default to communicate
  with any IP within the range 10.0.0.0/24 over TCP, provided that the target
  port is between the range 32000 and 32768.
  The following restrictions apply when using this field:
  
  The endPort field must be equal to or greater than the port field.
  endPort can only be defined if port is also defined.
  Both ports must be numeric.
  
  Note:Your cluster must be using a CNI plugin that
  supports the endPort field in NetworkPolicy specifications.
  If your network plugin
  does not support the endPort field and you specify a NetworkPolicy with that,
  the policy will be applied only for the single port field.
  Targeting multiple namespaces by label
  In this scenario, your Egress NetworkPolicy targets more than one namespace using their
  label names. For this to work, you need to label the target namespaces. For example:
  kubectl label namespace frontend namespace=frontend
  kubectl label namespace backend namespace=backend
  Add the labels under namespaceSelector in your NetworkPolicy document. For example:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
   name: egress-namespaces
  spec:
   podSelector:
   matchLabels:
   app: myapp
   policyTypes:
   - Egress
   egress:
   - to:
   - namespaceSelector:
   matchExpressions:
   - key: namespace
   operator: In
   values: ["frontend", "backend"]
  
  Note:It is not possible to directly specify the name of the namespaces in a NetworkPolicy.
  You must use a namespaceSelector with matchLabels or matchExpressions to select the
  namespaces based on their labels.
  Targeting a Namespace by its name
  The Kubernetes control plane sets an immutable label kubernetes.io/metadata.name on all
  namespaces, the value of the label is the namespace name.
  While NetworkPolicy cannot target a namespace by its name with some object field, you can use the
  standardized label to target a specific namespace.
  Pod lifecycle
  Note:The following applies to clusters with a conformant networking plugin and a conformant implementation of
  NetworkPolicy.
  When a new NetworkPolicy object is created, it may take some time for a network plugin
  to handle the new object. If a pod that is affected by a NetworkPolicy
  is created before the network plugin has completed NetworkPolicy handling,
  that pod may be started unprotected, and isolation rules will be applied when
  the NetworkPolicy handling is completed.
  Once the NetworkPolicy is handled by a network plugin,
  
  All newly created pods affected by a given NetworkPolicy will be isolated before they are started.
  Implementations of NetworkPolicy must ensure that filtering is effective throughout
  the Pod lifecycle, even
  ```