apiVersion: v1
kind: Pod
metadata:
  name: blocked-host-network
  namespace: security-baseline
spec:
  hostNetwork: true
  hostPID: true
  hostIPC: true
  restartPolicy: Never
  securityContext:
    runAsNonRoot: true
  containers:
    - name: app
      image: docker.io/library/busybox:1.36
      command: ["sleep", "3600"]
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
      resources:
        limits:
          cpu: 100m
          memory: 64Mi