# Kyverno / Pod Security "restricted" policy blocks okteto-bin and okteto-init-volume init containers

**URL:** <https://community.okteto.com/t/kyverno-pod-security-restricted-policy-blocks-okteto-bin-and-okteto-init-volume-init-containers/1480>\
**Category:** Help\
**Created:** [October 21, 2026, 10:20am UTC](https://community.okteto.com/t/kyverno-pod-security-restricted-policy-blocks-okteto-bin-and-okteto-init-volume-init-containers/1480 "2026-10-21T10:20:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mario](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/mario/32/292_2.png) [@mario](https://community.okteto.com/u/mario)\
**Post date:** [October 21, 2026, 10:20am UTC](https://community.okteto.com/t/kyverno-pod-security-restricted-policy-blocks-okteto-bin-and-okteto-init-volume-init-containers/1480/1 "2026-10-21T10:20:09Z")

</div>

Our Kyverno / Pod Security “restricted” policy blocks the `okteto-bin` and `okteto-init-volume` init containers on `okteto up`. How do I make them compliant?

---

<div class="post-metadata">

**Author:** ![mario](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/mario/32/292_2.png) [@mario](https://community.okteto.com/u/mario)\
**Post date:** [October 21, 2026, 10:20am UTC](https://community.okteto.com/t/kyverno-pod-security-restricted-policy-blocks-okteto-bin-and-okteto-init-volume-init-containers/1480/2 "2026-10-21T10:20:10Z")

</div>

Those init containers don’t inherit the pod’s `securityContext`; they only get what you set under `dev.<name>.securityContext` in `okteto.yml`. Add the restricted fields there:

```yaml
dev:
  api:
    securityContext:
      runAsUser: 1001
      runAsGroup: 1001
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]

```

`seccompProfile` and `privileged` aren’t configurable in the manifest yet, and `readOnlyRootFilesystem` must stay off for these init containers (they write files). Add a policy exception for those fields if needed.

See [Okteto Manifest reference](https://www.okteto.com/docs/reference/okteto-manifest/).