462 nachet detector command args (#473)

* 462 nachet detector command args fix security context
ai-cfia · Nov 20, 2024 · 990c318 · 990c318
1 parent 449ba4b
commit 990c318
Showing 1 changed file with 6 additions and 12 deletions.
diff --git a/kubernetes/aks/apps/nachet/base/nachet-rcnn-model-deployment.yaml b/kubernetes/aks/apps/nachet/base/nachet-rcnn-model-deployment.yaml
@@ -19,15 +19,6 @@ spec:
       labels:
         app: nachet-rcnn-detector
     spec:
-      securityContext:
-        runAsNonRoot: false
-        runAsUser: 1000
-        runAsGroup: 1000
-        readOnlyRootFilesystem: false
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
       affinity:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -51,7 +42,7 @@ spec:
           image: ghcr.io/ai-cfia/nachet-backend:29-azureml-seed-detector
           imagePullPolicy: Always
           command: ["/bin/sh", "-c"]
-          args: ['azmlinfsrv --entry_script /app/scoring_file_v_1_0_0.py']
+          args: ['cp -r /project/* /app/ && azmlinfsrv --entry_script /artifacts/scoring_file_v_1_0_0.py']
           envFrom:
             - secretRef:
                 name: nachet-rcnn-detector-secrets
@@ -61,7 +52,7 @@ spec:
             - name: logs
               mountPath: /app/logs
             - name: tmp
-              mountPath: /tmp
+              mountPath: /app
           livenessProbe:
             httpGet:
               path: /score
@@ -76,7 +67,10 @@ spec:
               cpu: "500m"
               memory: "2Gi"
           securityContext:
-            readOnlyRootFilesystem: true
+            runAsNonRoot: false
+            runAsUser: 1000
+            runAsGroup: 1000
+            readOnlyRootFilesystem: false
             allowPrivilegeEscalation: false
             capabilities:
               drop: