ToolHive Operator: Set ProxyRunner SecurityContext

[ChrisJBurns]

Description

As mentioned in this comment, we should set the securityContext for the ProxyRunner like we do with the individual MCPServers pods and containers themselves.

Change Proposal

For the ProxyRunner, we should implement the following securityContext configuration:

• pod:
  • runAsNonRoot: true
  • runAsUser: 1000
  • runAsGroup: 1000
  • fsGroup: 1000
• container:
  • priviledged: false
  • runAsNonRoot: true
  • runAsUser: 1000
  • runAsGroup: 1000
  • allowPrivilegeEscalation: false
  • readOnlyFileSystem: true

[dhruv-raithatha]

Hi @ChrisJBurns,

This issue looks well-scoped — I’d love to take a crack at it. I’ve gone through the CONTRIBUTING.md and will make sure to follow the guidelines.

Let me know if someone’s already working on it or if there’s anything specific I should be aware of before diving in.

Thanks!
Dhruv

[ChrisJBurns]

Awesome stuff! Let me know if you need any help