Tesoro forced to run as root user about tesoro

[ademariag]

good the idea to also add it to the binary! @uberspot

[uberspot]

Just for reference here btw, running as root is also not the best solution for this.
moby/moby#8460 (comment)
Ideally we'd just add the cap_net_bind_service=+ep to the tesoro binary and run that with the CAP privileges added to k8s (?). That would still be a smaller attack surface than full root perms.
Maybe this could be improved in a further PR.

[ademariag]

yes the idea for the upcoming 'kapitan-reference' deployment is to use CAP + readonly filesystem