apiVersion: apps/v1
kind: Deployment
metadata: { name: sandbox-runner, namespace: uqo-chat }
spec:
  replicas: 2
  selector: { matchLabels: { app: sandbox-runner } }
  template:
    metadata: { labels: { app: sandbox-runner } }
    spec:
      # runtimeClassName: gvisor   # enable if the cluster provides it
      securityContext: { runAsNonRoot: true, runAsUser: 10001, seccompProfile: { type: RuntimeDefault } }
      containers:
        - name: sandbox
          image: ghcr.io/ORG/uqo-chat-sandbox:latest
          ports: [{ containerPort: 8080 }]
          env: [{ name: SANDBOX_TOKEN, valueFrom: { secretKeyRef: { name: uqo-chat-secrets, key: SANDBOX_TOKEN } } }]
          securityContext: { readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities: { drop: [ALL] } }
          resources: { requests: { cpu: 250m, memory: 512Mi }, limits: { cpu: "1", memory: 1Gi } }
          volumeMounts: [{ name: tmp, mountPath: /tmp }]
      volumes: [{ name: tmp, emptyDir: { medium: Memory, sizeLimit: 200Mi } }]