A public-facing civic web Pod must not run as UID 0. Which security…

Question

A public-facing civic web Pod must not run as UID 0. Which securityContext setting best enforces that requirement?

Accepted Answer

Set runAsNonRoot: true on the container (or Pod) securityContext so the runtime rejects root. — runAsNonRoot is the bouncer that refuses a root-only ID at the door. Flip it to true and the kubelet won't start a container that would run as UID 0. Privileged mode, Services, and hostPID don't enforce non-root.

Answer

Set privileged: true so the container can drop root after startup.

Answer

Rely only on a ClusterIP Service; Services force containers to run as non-root.

Answer

Set hostPID: true so the process namespace inherits the node's non-root defaults.

A public-facing civic web Pod must not run as UID 0. Which securityContext setting best enforces that requirement?

Short Explanation

Full Explanation