# client-sandboxed: the sandboxed client. Identical to client-standard in every field
# the egress NetworkPolicy could select on, and in its hardening, differing only in the
# one line below.
#
#   runtimeClassName: isolated-sandbox
#
# That line makes the pod's containers run inside a Nitro sandbox of their own: a
# hardware-isolated lightweight VM with its own kernel. There is no node selector,
# toleration or sidecar: the RuntimeClass carries the scheduling constraints, and Auto
# Mode brings up a sandbox-capable node if none is available.
apiVersion: v1
kind: Pod
metadata:
  name: client-sandboxed
  labels:
    app: netpol-client        # the SAME label the policy selects on client-standard
spec:
  runtimeClassName: isolated-sandbox   # <-- the only field that differs from client-standard
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: client
      image: public.ecr.aws/docker/library/alpine:3.20
      imagePullPolicy: IfNotPresent
      command: ["sh", "-c"]
      args:
        - |
          echo "kernel:  $(uname -r)"
          echo "disks:   $(ls /sys/block | tr '\n' ' ')"
          sleep infinity
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
      resources:
        requests: { memory: 128Mi }