We’ve been planning for a long time to introduce securityContext: runAsNonRoot: true
as a requirement to our pod configurations for a while now.
Testing this today I’ve learnt that since v1.8.4
(I think) you also have to specify a particular UID for the user running the container, e.g runAsUser: 333
.
This means we not only have to tell developers to ensure their containers don’t run as root, but also specify a specific UID that they should run as, which makes this significantly more problematic for us to introduce.
Have I understood this correctly? What are others doing in this area? To leverage runAsNonRoot
is it now required that Docker containers run with a specific and known UID?
USER
in the Dockerfile and also consider using kubernetes.io/docs/concepts/policy/pod-security-policy to enforce the security context.USER
needs to have a numeric value to avoid running into CreateContainerConfigError: Error: container has runAsNonRoot and image has non-numeric user (username), cannot verify user is non-root.