Mehrdad Biukian b2ef1a13e8 image: pin numeric uid/gid for the nonroot user (#8316) ...

Kubernetes rejects a pod at admission when runAsNonRoot is set and the image
declares its user by name: "container has runAsNonRoot and image has
non-numeric user (nonroot), cannot verify user is non-root". The Dockerfile
set `USER nonroot:nonroot`, so the built image's config user was the name
rather than a uid, which the kubelet cannot verify.

distroless "nonroot" is uid/gid 65532, so pin the numeric id. The image runs
as the same user and the binary keeps cap_net_bind_service from the build
stage, so it can still bind :53. Verified by building the image: config user
is now `65532:65532`.

Fixes #7542

Signed-off-by: mehrdadbn9 <mehrdadbiukian@gmail.com>

2026-08-05 21:11:02 -07:00

1023 B

Raw Blame History

View Raw