How deeply does Google Anthos in Action cover non-root user?

Explains deployment-time identity configuration and verification, but defers image construction and broader privileged-container controls.

Non-root user

As explained in Google Anthos in Action

A nonroot user is an operating-system identity that does not have the unrestricted administrative privileges of root.

A non-root user is an operating-system identity without root’s unrestricted administrative privileges. Running containers with the least required permissions limits host exposure after a container breakout. section 13.6.1

Use a non-root identity to:

Avoid inheriting root as the default user from common container images such as busybox. section 13.6.1
Set the container user, primary group, and filesystem group through a Kubernetes security context. section 13.6.1
Reduce the impact of configurations that combine root execution with privileged access to host devices. section 13.4

Kubernetes deployment identity

Configure a Pod with runAsUser 1500, runAsGroup 1000, and fsGroup 1200. Confirm the effective identity and memberships with whoami and groups. IDs absent from a pulled image may produce unknown-ID warnings. section 13.6.1

spec:
 securityContext:
   runAsUser: 1500
   runAsGroup: 1000
   fsGroup: 1200

View the compact Pod securityContext manifest for assigning the non-root user and group identities. section 13.6.1

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

security contextconfigured by · A security context is security-related configuration or execution state associated with a subject, request, container, or runtime environment.
runAsNonRootconfigured by · runAsNonRoot is a Kubernetes security-context setting that requires a container process to run as a non-root user.
userkind of · A user is a person or other entity that interacts with, or is represented within, a system to access or use its functions.
serverused by · A server is a computer system or software process that receives requests from clients or other systems and provides resources, data, or services in response.
rootcontrasts with · A root or superuser is a privileged account or principal with broad administrative authority that can bypass ordinary permission restrictions within a system.
Pod Security Standardsconfigured by · Pod Security Standards are Kubernetes-defined security policy profiles that classify Pod security requirements into Privileged, Baseline, and Restricted levels.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.