Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-08-20 23:08:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

image: pin numeric uid/gid for the nonroot user (#8316)

Browse Source 
Kubernetes rejects a pod at admission when runAsNonRoot is set and the image
declares its user by name: "container has runAsNonRoot and image has
non-numeric user (nonroot), cannot verify user is non-root". The Dockerfile
set `USER nonroot:nonroot`, so the built image's config user was the name
rather than a uid, which the kubelet cannot verify.

distroless "nonroot" is uid/gid 65532, so pin the numeric id. The image runs
as the same user and the binary keeps cap_net_bind_service from the build
stage, so it can still bind :53. Verified by building the image: config user
is now `65532:65532`.

Fixes #7542

Signed-off-by: mehrdadbn9 <mehrdadbiukian@gmail.com>
This commit is contained in:
Mehrdad Biukian
2026-08-06 08:11:02 +04:00
committed by GitHub
parent c7e5424e7c
commit b2ef1a13e8
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
Dockerfile
View File

@@ -10,7 +10,13 @@ RUN setcap cap_net_bind_service=+ep /coredns
FROM ${BASE}
COPY --from=build /coredns /coredns
USER nonroot:nonroot
# Use the numeric uid/gid (distroless "nonroot" is 65532) rather than the named
# user so Kubernetes can verify the image runs as non-root when runAsNonRoot is
# set. A named user is rejected at admission ("container has runAsNonRoot and
# image has non-numeric user, cannot verify user is non-root"). The binary keeps
# cap_net_bind_service (set in the build stage), so it can still bind :53.
# Refs #7542.
USER 65532:65532
# Reset the working directory inherited from the base image back to the expected default:
# https://github.com/coredns/coredns/issues/7009#issuecomment-3124851608
WORKDIR /