A housing lottery service image runs as root by default, and the pl…

Question

A housing lottery service image runs as root by default, and the platform requires non-root containers. What should the image build include?

Accepted Answer

A non-root USER instruction (and matching ownership) so the container process need not run as root — Running as root in a container is like leaving the master key under the doormat. Create a non-root user in the image, chown what the app needs, and set USER so Kubernetes SecurityContext policies can happily refuse root.

Answer

A privileged SecurityContext so root inside the image is always allowed

Answer

A hostNetwork Pod so user IDs on the node override the image USER

Answer

A ClusterRoleBinding that maps root in the image to a restricted ServiceAccount

A housing lottery service image runs as root by default, and the platform requires non-root containers. What should the image build include?

Short Explanation

Full Explanation