An image declares USER 10001 and the city policy requires matching non-root identities. How should runAsUser and runAsGroup be chosen?
Select an answer to reveal the explanation.
Short Explanation
If the image already wears badge 10001, don't force it into a root costume. Align runAsUser/runAsGroup with the image USER so files and processes agree. Random UIDs or UID 0 fight the non-root goal.
Full Explanation
securityContext.runAsUser and runAsGroup should align with the non-root identity baked into the container image so the process can read its files and satisfy runAsNonRoot policies. Forcing UID 0, root group defaults, or unstable random UIDs creates permission failures or policy violations.