fix: refactor securityContext

This commit aim at adding a securityContext for
pod and container in Deployment and Job,
it include livekit pods as well

It adds 2 values :
- podSecurityContext : for pods
- securityContext : for containers

Please note that `celeryBackend` Deployment does
not have any values defined in `values.meet.yaml` at the moment.

CHANGELOG.md

@@ -10,6 +10,8 @@ and this project adheres to
 
 ### Changed
 
+- ⚡️(helm) Add pod and container securityContext #4805
+- ♻️(backend) configurable SESSION_ENGINE #1038 #1154
 - ♿️(frontend) fix sidepanel accessibility aria-label #1182
 - ♿️(frontend) fix more tools heading hierarchy #1181
 - ♿️(fronted) improve button descriptions for More tools actions #1184
@@ -17,11 +19,17 @@ and this project adheres to
 - 💄(custom-background) add upload indicator with preview #1183
 - ♿️(backend) improve logo accessibility in recording email notification #1092
 - ♿️(summary) improve accessibility of transcription download link #1187
+- 💄(frontend) show OS-specific shortcut in participant tile hint #1193
+- ⬆️(frontend) bump flatted from 3.3.1 to 3.4.2 in /src/frontend #1188
+- ⬆️️️(frontend) bump undici from 6.23.0 to 6.24.1 in /src/frontend
+- ⬆️️️(frontend) bump hono from 4.12.2 to 4.12.7 in /src/frontend
+- ⬆️️️(frontend) bump dompurify from 3.3.1 to 3.3.2 in /src/frontend
 
 ### Fixed
 
 - 🐛(frontend) disable personal custom background while deleting #1183
 - 🐛(frontend) auto-select new custom background when not logged in #1183
+- 🐛(frontend) fix device selection not applying during conference #1156
 
 ## [1.11.0] - 2026-03-19
 

src/backend/meet/settings.py

@@ -452,7 +452,11 @@ class Base(Configuration):
     CELERY_BROKER_TRANSPORT_OPTIONS = values.DictValue({}, environ_prefix=None)
 
     # Session
-    SESSION_ENGINE = "django.contrib.sessions.backends.cache"
+    SESSION_ENGINE = values.Value(
+        default="django.contrib.sessions.backends.cache",
+        environ_name="SESSION_ENGINE",
+        environ_prefix=None,
+    )
     SESSION_CACHE_ALIAS = "default"
     SESSION_COOKIE_AGE = values.PositiveIntegerValue(
         default=60 * 60 * 12, environ_name="SESSION_COOKIE_AGE", environ_prefix=None

src/frontend/Dockerfile

@@ -1,14 +1,16 @@
 FROM node:20-alpine AS frontend-deps
 
+USER node
+
 WORKDIR /home/frontend/
 
-COPY ./src/frontend/package.json ./package.json
-COPY ./src/frontend/package-lock.json ./package-lock.json
+COPY --chown=node:node ./src/frontend/package.json ./package.json
+COPY --chown=node:node ./src/frontend/package-lock.json ./package-lock.json
 
 RUN npm ci
 
-COPY .dockerignore ./.dockerignore
-COPY ./src/frontend/ .
+COPY --chown=node:node .dockerignore ./.dockerignore
+COPY --chown=node:node ./src/frontend/ .
 
 ### ---- Front-end builder image ----
 FROM frontend-deps AS meet
@@ -17,6 +19,8 @@ WORKDIR /home/frontend
 
 FROM frontend-deps AS meet-dev
 
+USER node
+
 WORKDIR /home/frontend
 
 EXPOSE 8080

src/frontend/package-lock.json

@@ -6269,10 +6269,13 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz",
-      "integrity": "sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.2.tgz",
+      "integrity": "sha512-6obghkliLdmKa56xdbLOpUZ43pAR6xFy1uOrxBaIDjT+yaRuuybLjGS9eVBoSR/UPU5fq3OXClEHLJNGvbxKpQ==",
       "license": "(MPL-2.0 OR Apache-2.0)",
+      "engines": {
+        "node": ">=20"
+      },
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
       }
@@ -7158,10 +7161,11 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.1.tgz",
-      "integrity": "sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==",
-      "dev": true
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "dev": true,
+      "license": "ISC"
     },
     "node_modules/for-each": {
       "version": "0.3.3",
@@ -7628,9 +7632,9 @@
       "integrity": "sha512-Rf4YVNYpKjZ6ASAmibcwTNciQ5Co5Ztq6iZPEykHpkoflnD/K5ryE/rHehFsTm4NJj8nKDhbi3eKBWGogmNnkg=="
     },
     "node_modules/hono": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.2.tgz",
-      "integrity": "sha512-gJnaDHXKDayjt8ue0n8Gs0A007yKXj4Xzb8+cNjZeYsSzzwKc0Lr+OZgYwVfB0pHfUs17EPoLvrOsEaJ9mj+Tg==",
+      "version": "4.12.8",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.8.tgz",
+      "integrity": "sha512-VJCEvtrezO1IAR+kqEYnxUOoStaQPGrCmX3j4wDTNOcD1uRPFpGlwQUIW8niPuvHXaTUxeOUl5MMDGrl+tmO9A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11107,9 +11111,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "version": "6.24.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
+      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

src/frontend/src/features/rooms/livekit/components/ParticipantTile.tsx

@@ -31,6 +31,8 @@ import { FullScreenShareWarning } from './FullScreenShareWarning'
 import { ParticipantName } from './ParticipantName'
 import { getParticipantName } from '@/features/rooms/utils/getParticipantName'
 import { useTranslation } from 'react-i18next'
+import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'
+import { formatShortcutLabel } from '@/features/shortcuts/formatLabels'
 import { KeyboardShortcutHint } from './KeyboardShortcutHint'
 
 export function TrackRefContextIfNeeded(
@@ -237,7 +239,13 @@ export const ParticipantTile: (
           )}
         </ParticipantContextIfNeeded>
       </TrackRefContextIfNeeded>
-      <KeyboardShortcutHint>{t('toolbarHint')}</KeyboardShortcutHint>
+      <KeyboardShortcutHint>
+        {t('toolbarHint', {
+          shortcut: formatShortcutLabel(
+            getShortcutDescriptorById('open-shortcuts')?.shortcut
+          ),
+        })}
+      </KeyboardShortcutHint>
     </div>
   )
 })

src/frontend/src/features/rooms/livekit/components/controls/Device/SelectDevice.tsx

@@ -69,10 +69,10 @@ const SelectDevicePermissions = <T extends string | number>({
       iconComponent={iconComponent}
       placeholder={items.length === 0 ? t('loading') : t('select')}
       selectedKey={selectedKey}
-      onSelectionChange={(key) => {
+      onSelectionChange={async (key) => {
         if (key === selectedKey) return
+        await setActiveMediaDevice(key as string)
         onSubmit?.(key as string)
-        setActiveMediaDevice(key as string)
       }}
       {...props}
     />

src/frontend/src/locales/de/rooms.json

@@ -620,7 +620,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Optionen für {{name}}",
-    "toolbarHint": "Ctrl+Shift+/: Direkt auf die Tastenkürzel zugreifen.",
+    "toolbarHint": "{{shortcut}}: Direkt auf die Tastenkürzel zugreifen.",
     "pin": {
       "enable": "Anheften",
       "disable": "Lösen"

src/frontend/src/locales/en/rooms.json

@@ -619,7 +619,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options for {{name}}",
-    "toolbarHint": "Ctrl+Shift+/: access shortcuts directly.",
+    "toolbarHint": "{{shortcut}}: access shortcuts directly.",
     "pin": {
       "enable": "Pin",
       "disable": "Unpin"

src/frontend/src/locales/fr/rooms.json

@@ -619,7 +619,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Options pour {{name}}",
-    "toolbarHint": "Ctrl+Shift+/ : accéder directement aux raccourcis.",
+    "toolbarHint": "{{shortcut}} : accéder directement aux raccourcis.",
     "pin": {
       "enable": "Épingler",
       "disable": "Annuler l'épinglage"

src/frontend/src/locales/nl/rooms.json

@@ -619,7 +619,7 @@
   },
   "participantTileFocus": {
     "containerLabel": "Opties voor {{name}}",
-    "toolbarHint": "Ctrl+Shift+/: direct toegang tot de sneltoetsen.",
+    "toolbarHint": "{{shortcut}}: direct toegang tot de sneltoetsen.",
     "pin": {
       "enable": "Pinnen",
       "disable": "Losmaken"

src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl

@@ -41,3 +41,15 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl

@@ -28,6 +28,16 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
 
 loadBalancer:
   type: nginx

src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl

@@ -112,6 +112,21 @@ backend:
         - key: cacert.pem
           path: cacert.pem
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
 frontend:
 
   replicas: 1
@@ -121,6 +136,21 @@ frontend:
     pullPolicy: Always
     tag: "latest"
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
 ingress:
   enabled: true
   host: meet.127.0.0.1.nip.io
@@ -136,7 +166,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-  
+
   ingressAssets:
     enabled: false
 
@@ -160,12 +190,27 @@ summary:
     WEBHOOK_URL: https://www.mock-impress.com/webhook/
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
-  
+
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
     tag: "latest"
-  
+
   command:
     - "uvicorn"
     - "summary.main:app"
@@ -197,6 +242,21 @@ celeryTranscribe:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -233,6 +293,21 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always

src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl

@@ -44,3 +44,15 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl

@@ -28,6 +28,16 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
 
 loadBalancer:
   type: nginx

src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

@@ -86,6 +86,20 @@ backend:
     CELERY_ENABLED: True
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
 
   migrate:
     command:
@@ -134,6 +148,21 @@ frontend:
 
   replicas: 1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-frontend-generic
     pullPolicy: Always
@@ -154,7 +183,7 @@ ingressWebhook:
 posthog:
   ingress:
     enabled: false
-  
+
   ingressAssets:
     enabled: false
 
@@ -180,12 +209,27 @@ summary:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-  
+
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
     tag: "latest"
-  
+
   command:
     - "uvicorn"
     - "summary.main:app"
@@ -217,7 +261,22 @@ celeryTranscribe:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-  
+
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -256,6 +315,21 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -283,6 +357,21 @@ agents:
     {{- end }}
     ENABLE_SILERO_VAD: "false"
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-agents
     pullPolicy: Always

src/helm/env.d/dev/values.egress.yaml.gotmpl

@@ -41,3 +41,15 @@ autoscaling:
 
 nodeSelector: {}
 resources: {}
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

src/helm/env.d/dev/values.livekit.yaml.gotmpl

@@ -28,6 +28,17 @@ livekit:
     urls:
         - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
 
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  capabilities:
+    drop:
+    - ALL
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+
 loadBalancer:
   type: nginx
   annotations:

src/helm/env.d/dev/values.meet.yaml.gotmpl

@@ -96,6 +96,20 @@ backend:
     ROOM_TELEPHONY_ENABLED: True
     SSL_CERT_FILE: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
 
   migrate:
     command:
@@ -144,6 +158,21 @@ frontend:
 
   replicas: 1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-frontend
     pullPolicy: Always
@@ -189,6 +218,21 @@ summary:
     CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -225,6 +269,21 @@ celeryTranscribe:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always
@@ -261,6 +320,21 @@ celerySummarize:
     CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
     TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
 
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+
   image:
     repository: localhost:5001/meet-summary
     pullPolicy: Always

src/helm/meet/templates/agents_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.agents.shareProcessNamespace }}
+      {{- with .Values.agents.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.agents.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_job_createsuperuser.yaml

@@ -30,6 +30,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/backend_job_migrate.yaml

@@ -30,6 +30,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      {{- with .Values.backend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.backend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_backend_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryBackend.shareProcessNamespace }}
+      {{- with .Values.celeryBackend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celeryBackend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_summarize_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celerySummarize.shareProcessNamespace }}
+      {{- with .Values.celerySummarize.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celerySummarize.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/celery_transcribe_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.celeryTranscribe.shareProcessNamespace }}
+      {{- with .Values.celeryTranscribe.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.celeryTranscribe.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/frontend_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }}
+      {{- with .Values.frontend.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.frontend.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/templates/summary_deployment.yaml

@@ -31,6 +31,10 @@ spec:
         - name: {{ include "meet.secret.dockerconfigjson.name" (dict "fullname" (include "meet.fullname" .) "imageCredentials" $.Values.image.credentials) }}
       {{- end }}
       shareProcessNamespace: {{ .Values.summary.shareProcessNamespace }}
+      {{- with .Values.summary.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         {{- with .Values.summary.sidecars }}
           {{- toYaml . | nindent 8 }}

src/helm/meet/values.yaml

@@ -216,9 +216,12 @@ backend:
     ttlSecondsAfterFinished: 30
     backoffLimit: 2
 
-  ## @param backend.securityContext Configure backend Pod security context
+  ## @param backend.securityContext Configure backend Container security context
   securityContext: null
 
+  ## @param backend.podSecurityContext Configure backend Pod security context
+  podSecurityContext: null
+
   ## @param backend.envVars Configure backend container environment variables
   ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -359,9 +362,12 @@ frontend:
   ## @param frontend.sidecars Add sidecars containers to frontend deployment
   sidecars: []
 
-  ## @param frontend.securityContext Configure frontend Pod security context
+  ## @param frontend.securityContext Configure frontend Container security context
   securityContext: null
 
+  ## @param frontend.podSecurityContext Configure frontend Pod security context
+  podSecurityContext: null
+
   ## @param frontend.envVars Configure frontend container environment variables
   ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -533,9 +539,12 @@ summary:
   ## @param summary.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param summary.securityContext Configure summary Pod security context
+  ## @param summary.securityContext Configure summary Container security context
   securityContext: null
 
+  ## @param summary.podSecurityContext Configure summary Pod security context
+  podSecurityContext: null
+
   ## @param summary.envVars Configure summary container environment variables
   ## @extra summary.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra summary.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -646,9 +655,12 @@ celeryBackend:
   ## @param celeryBackend.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryBackend.securityContext Configure celeryBackend Pod security context
+  ## @param celeryBackend.securityContext Configure celeryBackend Container security context
   securityContext: null
 
+  ## @param celeryBackend.podSecurityContext Configure celeryBackend Pod security context
+  podSecurityContext: null
+
   ## @param celeryBackend.envVars Configure celeryBackend container environment variables
   ## @extra celeryBackend.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryBackend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -755,9 +767,12 @@ celeryTranscribe:
   ## @param celeryTranscribe.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Pod security context
+  ## @param celeryTranscribe.securityContext Configure celeryTranscribe Container security context
   securityContext: null
 
+  ## @param celeryTranscribe.podSecurityContext Configure celeryTranscribe Pod security context
+  podSecurityContext: null
+
   ## @param celeryTranscribe.envVars Configure celeryTranscribe container environment variables
   ## @extra celeryTranscribe.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celeryTranscribe.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -864,9 +879,12 @@ celerySummarize:
   ## @param celerySummarize.migrateJobAnnotations Annotations for the migrate job
   migrateJobAnnotations: {}
 
-  ## @param celerySummarize.securityContext Configure celerySummarize Pod security context
+  ## @param celerySummarize.securityContext Configure celerySummarize Container security context
   securityContext: null
 
+  ## @param celerySummarize.podSecurityContext Configure celerySummarize Pod security context
+  podSecurityContext: null
+
   ## @param celerySummarize.envVars Configure celerySummarize container environment variables
   ## @extra celerySummarize.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra celerySummarize.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
@@ -963,9 +981,12 @@ agents:
   ## @param agents.sidecars Add sidecars containers to agents deployment
   sidecars: []
 
-  ## @param agents.securityContext Configure agents Pod security context
+  ## @param agents.securityContext Configure agents Container security context
   securityContext: null
 
+  ## @param agents.podSecurityContext Configure agents Pod security context
+  podSecurityContext: null
+
   ## @param agents.envVars Configure agents container environment variables
   ## @extra agents.envVars.BY_VALUE Example environment variable by setting value directly
   ## @extra agents.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap