update restricted shell to force (–no-kill) option.

kubernetes/03-deployment.yaml

@@ -97,7 +97,7 @@ spec:
               "--port",
               "8082",
               "--command",
-              "/usr/local/bin/restricted-shell.sh",
+              "/usr/local/bin/session-shell.sh",
             ]
 
           ports:
@@ -115,6 +115,13 @@ spec:
               value: "America/New_York"
             - name: RUST_LOG
               value: "info"
+            # Disable socktop's local process-kill feature for every socktop
+            # launched anywhere under this pod, regardless of command line.
+            # The restricted shell also passes --no-kill, but this is the layer
+            # a visitor cannot route around (no way to unset env from the
+            # restricted shell).
+            - name: SOCKTOP_NO_KILL
+              value: "1"
 
           resources:
             limits:
@@ -158,14 +165,24 @@ spec:
             - name: socktop-home
               mountPath: /var/lib/socktop
 
+          # webterm-server runs as in-container root holding ONLY
+          # CAP_SETUID/CAP_SETGID (everything else dropped, no privilege
+          # escalation), so it can drop each websocket session to the
+          # unprivileged `demo` user via session-shell.sh. The kernel then
+          # refuses any signal a session aims at the server, the agent
+          # (running as `socktop`), or another session's UID — the kill
+          # feature's UI gating stops being the only line of defense.
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
+              add:
+                - SETUID
+                - SETGID
             readOnlyRootFilesystem: false
-            runAsUser: 100
-            runAsGroup: 101
+            runAsUser: 0
+            runAsGroup: 0
 
       volumes:
         - name: config