A container that runs as root inside its container is not automatically root on the Kubernetes node, but root still increases the container’s privileges. Set securityContext.runAsNonRoot: true to require the process to run as a non-root user. section 12.3
Use runAsNonRoot as part of a locked-down Pod configuration. A typical configuration also selects a numeric user, prevents privilege escalation, and drops all Linux capabilities. section 12.3 section 12.5.1
Apply the setting with these operational expectations:
- Set runAsNonRoot at the Pod or container security-context level. section 12.3
- Choose an image that can start and operate as a non-root user, such as user 1001. section 12.5.1
- Enforce the requirement across a namespace with Pod Security admission and the restricted Pod Security Standard. section 12.5.1
- Expect noncompliant Pods to be rejected before creation, with an error identifying runAsNonRoot and related missing settings. section 12.5.1
A compliant Pod security context
A Pod can specify runAsNonRoot: true and runAsUser: 1001, while setting allowPrivilegeEscalation: false and dropping ALL capabilities. This combination satisfies the security requirements shown for the restricted profile. section 12.5.1
Listing 12.12 Chapter12/12.5_PodSecurityAdmission/nonroot_pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: timeserver-pod
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: timeserver-container
image: docker.io/wdenniss/timeserver:7
securityContext: #1
runAsNonRoot: true #1
allowPrivilegeEscalation: false #1
runAsUser: 1001 #1
capabilities: #1
drop: #1
- ALL #1
#1 Security context required by the restricted profile
Browse the complete non-root Pod manifest, including the restricted-profile security context and RuntimeDefault seccomp profile. section 12.5.1
