spb/uqo-chat

1apiVersion: apps/v12kind: Deployment3metadata: { name: sandbox-runner, namespace: uqo-chat }4spec:5  replicas: 26  selector: { matchLabels: { app: sandbox-runner } }7  template:8    metadata: { labels: { app: sandbox-runner } }9    spec:10      # runtimeClassName: gvisor   # enable if the cluster provides it11      securityContext: { runAsNonRoot: true, runAsUser: 10001, seccompProfile: { type: RuntimeDefault } }12      containers:13        - name: sandbox14          image: ghcr.io/ORG/uqo-chat-sandbox:latest15          ports: [{ containerPort: 8080 }]16          env: [{ name: SANDBOX_TOKEN, valueFrom: { secretKeyRef: { name: uqo-chat-secrets, key: SANDBOX_TOKEN } } }]17          securityContext: { readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities: { drop: [ALL] } }18          resources: { requests: { cpu: 250m, memory: 512Mi }, limits: { cpu: "1", memory: 1Gi } }19          volumeMounts: [{ name: tmp, mountPath: /tmp }]20      volumes: [{ name: tmp, emptyDir: { medium: Memory, sizeLimit: 200Mi } }]21