feat: add configurable field-level restrictions for container and pod overrides

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -146,6 +146,23 @@ type RoutingConfig struct {
 	TLSCertificateConfigmapRef *ConfigmapReference `json:"tlsCertificateConfigmapRef,omitempty"`
 }
 
+// OverrideConfig defines configuration options for controlling which fields are allowed
+// in `container-overrides` and `pod-overrides` DevWorkspace attributes.
+// Entries support value restrictions: "fieldName" denies the field entirely,
+// "fieldName=value" denies only the specific value (other values are allowed).
+type OverrideConfig struct {
+	// DeniedContainerOverrideFields defines a list of container-level fields that are denied
+	// in `container-overrides` attributes. The following fields are always
+	// restricted regardless of this setting: `name`, `image`, `command`, `args`, `ports`, `env`.
+	// +kubebuilder:validation:Optional
+	DeniedContainerOverrideFields []string `json:"deniedContainerOverrideFields,omitempty"`
+	// DeniedPodOverrideFields defines a list of pod-level fields that are denied
+	// in `pod-overrides` attributes. The following fields are always restricted
+	// regardless of this setting: `containers`, `initContainers`.
+	// +kubebuilder:validation:Optional
+	DeniedPodOverrideFields []string `json:"deniedPodOverrideFields,omitempty"`
+}
+
 type WorkspaceConfig struct {
 	// ProjectCloneConfig defines configuration related to the project clone init container
 	// that is used to clone git projects into the DevWorkspace.
@@ -264,6 +281,9 @@ type WorkspaceConfig struct {
 	// InitContainers defines a list of Kubernetes init containers that are automatically injected into all workspace pods.
 	// Typical uses cases include injecting organization tools/configs, initializing persistent home, etc.
 	InitContainers []corev1.Container `json:"initContainers,omitempty"`
+	// Overrides defines configuration options for controlling which fields are allowed
+	// in `container-overrides` and `pod-overrides` DevWorkspace attributes.
+	Overrides *OverrideConfig `json:"overrides,omitempty"`
 }
 
 type WebhookConfig struct {

controllers/workspace/devworkspace_controller.go

@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"github.com/devfile/devworkspace-operator/pkg/library/initcontainers"
+	"github.com/devfile/devworkspace-operator/pkg/library/overrides"
 	"github.com/devfile/devworkspace-operator/pkg/library/ssh"
 
 	dw "github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2"
@@ -339,6 +340,7 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		workspace.Config.Workspace.DefaultContainerResources,
 		workspace.Config.Workspace.ContainerResourceCaps,
 		workspace.Config.Workspace.PostStartTimeout,
+		overrides.GetDeniedContainerOverrideFields(workspace),
 		postStartDebugTrapSleepDuration,
 	)
 	if err != nil {

docs/dwo-configuration.md

@@ -310,3 +310,44 @@ config:
 ### Execution Order
 
 Custom init containers are injected after the project-clone init container in the order they are defined in the configuration. The `init-persistent-home` container runs in this sequence along with other custom init containers.
+
+## Restricting override fields
+
+The DevWorkspace Operator allows cluster administrators to restrict which fields
+can be set via `pod-overrides` and `container-overrides` attributes.
+Fields are restricted using a deny list -- by default, all fields are allowed unless explicitly denied.
+
+The deny list supports two formats:
+
+- `"fieldName"` -- denies the field entirely, regardless of value
+- `"fieldName=value"` -- denies only a specific value for the field
+
+For nested fields such as securityContext or volumes, use dot notation: `securityContext.privileged=true`.
+
+On Kubernetes, the operator ships with default denied fields that align
+with the Pod Security Standards baseline profile.
+On OpenShift, no fields are denied by default since Security Context Constraints (SCC)
+already enforce security policies at the admission level.
+
+**Important:** Configuring `deniedContainerOverrideFields` or `deniedPodOverrideFields`
+**replaces** the platform defaults entirely. Admins who want to extend the default
+deny list must re-include the default entries alongside any additional restrictions.
+
+For example, on Kubernetes, to add `volumeMounts` and `lifecycle` restrictions
+while keeping the default denied container fields:
+
+```yaml
+apiVersion: controller.devfile.io/v1alpha1
+kind: DevWorkspaceOperatorConfig
+metadata:
+  name: devworkspace-operator-config
+config:
+  workspace:
+    overrides:
+      deniedContainerOverrideFields:
+        # Default denied fields (must be re-listed to retain them)
+        ...
+        # Additional restrictions
+        - "volumeMounts"
+        - "lifecycle"
+```

pkg/config/common_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -56,6 +56,7 @@ func setupForTest(t *testing.T) {
 	infrastructure.InitializeForTesting(infrastructure.Kubernetes)
 	setDefaultPodSecurityContext()
 	setDefaultContainerSecurityContext()
+	setDefaultOverrideConfig()
 	configNamespace = testNamespace
 	originalDefaultConfig := defaultConfig.DeepCopy()
 	t.Cleanup(func() {

pkg/config/defaults.go

@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -116,7 +116,30 @@ var (
 	}
 	defaultKubernetesContainerSecurityContext = &corev1.SecurityContext{}
 	defaultOpenShiftPodSecurityContext        = &corev1.PodSecurityContext{}
-	defaultOpenShiftContainerSecurityContext  = &corev1.SecurityContext{
+
+	defaultOpenShiftOverrideConfig = &v1alpha1.OverrideConfig{
+		DeniedContainerOverrideFields: []string{},
+		DeniedPodOverrideFields:       []string{},
+	}
+	defaultKubernetesOverrideConfig = &v1alpha1.OverrideConfig{
+		DeniedContainerOverrideFields: []string{
+			"securityContext.privileged=true",
+			"securityContext.runAsNonRoot=false",
+			"securityContext.runAsUser=0",
+			"securityContext.allowPrivilegeEscalation=true",
+			"securityContext.procMount=Unmasked",
+		},
+		DeniedPodOverrideFields: []string{
+			"hostNetwork=true",
+			"hostPID=true",
+			"hostIPC=true",
+			"securityContext.runAsNonRoot=false",
+			"securityContext.runAsUser=0",
+			"volumes.hostPath",
+		},
+	}
+
+	defaultOpenShiftContainerSecurityContext = &corev1.SecurityContext{
 		ReadOnlyRootFilesystem:   pointer.Bool(false),
 		RunAsNonRoot:             pointer.Bool(true),
 		AllowPrivilegeEscalation: pointer.Bool(false),
@@ -157,3 +180,15 @@ func setDefaultContainerSecurityContext() error {
 	}
 	return nil
 }
+
+func setDefaultOverrideConfig() error {
+	if !infrastructure.IsInitialized() {
+		return fmt.Errorf("can not set default override config, infrastructure not detected")
+	}
+	if infrastructure.IsOpenShift() {
+		defaultConfig.Workspace.Overrides = defaultOpenShiftOverrideConfig
+	} else {
+		defaultConfig.Workspace.Overrides = defaultKubernetesOverrideConfig
+	}
+	return nil
+}