docs: document container security context in v1.6.6

[fgksgf]

Summary

• Document Pod-level and container-level security context configuration for CR-generated containers starting from TiDB Operator v1.6.6.
• Add a copyable PD example that combines container identity settings with Pod-level fsGroup.
• Clarify supported CRs and container paths, configuration precedence, rolling updates, and migration from deprecated TiKV/TiFlash privileged fields.

Why

The existing guide only documents Pod-level podSecurityContext. The feature introduced by pingcap/tidb-operator#6404 and cherry-picked to release-1.6 by pingcap/tidb-operator#6858 also lets users configure generated containers directly. Without precise scope and precedence guidance, users can select unsupported fields or create containers that cannot write to their volumes.

How

• Separate Pod-level and container-level configuration into dedicated sections.
• Distinguish TidbCluster and DMCluster component paths from TidbDashboard, TidbNGMonitoring, and TidbMonitor paths, and identify CRs that only support Pod-level settings.
• Explain Pod/container precedence, enumerate supported auxiliary-container fields, and warn that adding securityContext disables the legacy TiKV/TiFlash privileged fallback.

Testing

• npx --yes markdownlint-cli@0.47.0 en/containers-run-as-non-root-user.md zh/containers-run-as-non-root-user.md
• npx --yes markdown-link-check@3.13.7 for both changed files using the repository link-check configuration
• git diff --check

Risks and Reviewer Focus

• The documentation is based on the current release-1.6 implementation. The public v1.6.6 tag has not been published yet, so the version statement should remain aligned with the release schedule.
• Updating securityContext on a deployed component changes its Pod template and triggers a rolling update.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 49d2e3ba-b030-4056-88a1-3fa08c47cf9b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qiancai]

Rest LGTM

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-08-03 03:47:34.6189845 +0000 UTC m=+2413440.655079546: ☑️ agreed by qiancai.

[ti-chi-bot]

@time-and-fate: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

@qiancai: Your lgtm message is repeated, so it is ignored.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[qiancai]

/approve

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiancai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [qiancai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-1.x: #3170.