apiVersion: batch/v1
kind: Job
metadata:
  name: intelsgx-demo-job
  labels:
    jobgroup: intelsgx-demo
spec:
  template:
    metadata:
      labels:
        jobgroup: intelsgx-demo
    spec:
      restartPolicy: Never
      containers:
        -
          name: intelsgx-demo-job-1
          image: intel/sgx-sdk-demo:devel
          imagePullPolicy: IfNotPresent
          workingDir: "/opt/intel/sgx-sample-app/"
          command: ["/opt/intel/sgx-sample-app/sgx-sample-app"]
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          resources:
            limits:
              sgx.intel.com/epc: "512Ki"