How can we make sure at the node level that pods do not run as root user

General Discussions
1

Hello Guys,

This is an interview question. The interviewer asked what can we do to make sure at the node level that pods do not run as root user ?

My answer was, if we run the kubernetes server and client components as a non-root user then the container it spaws will also run as a non-root user.

Is that right ? Can we run the kubernetes server and client components as a non-root user and would it spawn a non-root container if we did ?

2

:wave: hello @GodsGiftedChild,

From my knowledge, this is not a true state.

There are two approaches to how you can control the level of access for the container namespace isolation towards host system calls.

  1. podSecurityContext → holds pod-level security attributes and common container settings.
    • more about this one use kubectl explain deployment.spec.template.spec.securityContext on you’re cluster side
  2. securityContext → holds a security configuration that will be applied to a container.
    • more about this one use kubectl explain deployment.spec.template.spec.containers.securityContext on you’re cluster side

NOTE: When both are set, the values in SecurityContext take precedence.

This is in high-level view, but if want to go deep into it then you can check this documentation → security-context