examples: Pin privileged nsenter DaemonSets to MCR alpine

[Sebastien Tardif (SebTardif)]

Pin the three privileged host-nsenter DaemonSets to the same MCR Alpine image the other remediations in this repo already use.

Problem

These examples run privileged: true with hostPID / hostNetwork and pull unpinned image: alpine (implicit latest) with IfNotPresent:

• examples/kubelet/enable-anonymous-auth-for-non-rbac.yaml
• examples/kubelet/kubelet-parameters-ds.yaml
• examples/runc/downgraderunc.yaml

A first pull of alpine:latest becomes whatever Docker Hub served that day, then stays cached. Sibling remediations already pin mcr.microsoft.com/azure-policy/alpine:prod_20200505.1 (disable-azsecd.yaml, iptables/snat_exemption_ds.yaml, unattended-upgrades/daemonset.yaml).

Present since the original manifests (9d0e5f607 2021-05-06, b4c5e6c9d 2021-03-30).

Change

Replace image: alpine with mcr.microsoft.com/azure-policy/alpine:prod_20200505.1 in those three files only. Commands and security context are unchanged.

Validation

Mechanical pin to an existing in-repo image. No example test harness for these YAML files. Confirmed with rg that the three files no longer use image: alpine and match the sibling tag.

Related

• Same image in examples/disable-azsecd.yaml

[Copilot]

🟢 Approval recommended

The changes are a straightforward, consistent image pin across the specified manifests with no functional or structural YAML issues introduced.

Pull request overview

This PR improves supply-chain safety and repeatability for privileged nsenter DaemonSet examples by replacing the unpinned alpine image reference with a pinned Microsoft Container Registry (MCR) Alpine image that’s already used by other remediations in this repo.

Changes:

• Update image: alpine to image: mcr.microsoft.com/azure-policy/alpine:prod_20200505.1 in three privileged host-namespace DaemonSet manifests.
• Keep commands, privileges, and imagePullPolicy unchanged to preserve example behavior.

File summaries

File	Description
examples/runc/downgraderunc.yaml	Pins the nsenter container image to the repo’s existing MCR Alpine tag.
examples/kubelet/kubelet-parameters-ds.yaml	Pins the DaemonSet container image to the same MCR Alpine tag for consistency and determinism.
examples/kubelet/enable-anonymous-auth-for-non-rbac.yaml	Pins the nsenter container image to the repo’s existing MCR Alpine tag.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Simon Waight (sjwaight)]

Mutaz Nassar (@mutazn) and Jorge Palma (@palma21) to review as original creators of these. I do note these examples are quite old, so not sure if they are still applicable.