docs: document container security context in v1.6.6 (#3165)

[ti-chi-bot]

This is an automated cherry-pick of #3165

Summary

• Document Pod-level and container-level security context configuration for CR-generated containers starting from TiDB Operator v1.6.6.
• Add a copyable PD example that combines container identity settings with Pod-level fsGroup.
• Clarify supported CRs and container paths, configuration precedence, rolling updates, and migration from deprecated TiKV/TiFlash privileged fields.

Why

The existing guide only documents Pod-level podSecurityContext. The feature introduced by pingcap/tidb-operator#6404 and cherry-picked to release-1.6 by pingcap/tidb-operator#6858 also lets users configure generated containers directly. Without precise scope and precedence guidance, users can select unsupported fields or create containers that cannot write to their volumes.

How

• Separate Pod-level and container-level configuration into dedicated sections.
• Distinguish TidbCluster and DMCluster component paths from TidbDashboard, TidbNGMonitoring, and TidbMonitor paths, and identify CRs that only support Pod-level settings.
• Explain Pod/container precedence, enumerate supported auxiliary-container fields, and warn that adding securityContext disables the legacy TiKV/TiFlash privileged fallback.

Testing

• npx --yes markdownlint-cli@0.47.0 en/containers-run-as-non-root-user.md zh/containers-run-as-non-root-user.md
• npx --yes markdown-link-check@3.13.7 for both changed files using the repository link-check configuration
• git diff --check

Risks and Reviewer Focus

• The documentation is based on the current release-1.6 implementation. The public v1.6.6 tag has not been published yet, so the version statement should remain aligned with the release schedule.
• Updating securityContext on a deployed component changes its Pod template and triggers a rolling update.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4112920c-113a-4647-9d5a-57786c9c4356

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qiancai]

/approve

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiancai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [qiancai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment