docker - k8s securityContext.runAsUser与Dockerfile USER指令

Question

在我的k8s部署的securityContext.runAsUser部分中选择要运行的用户与在Dockerfile中使用USER myuser指定用户之间有什么区别？

我特别感兴趣是否存在与USER myuser下不存在的securityContext相关的安全性问题

Answer 1

MustRunAsNonRoot

Users and groups

Requires that the pod be submitted with a non-zero runAsUser or have the USER directive defined (using a numeric UID) in the image. Pods which have specified neither runAsNonRoot nor runAsUser settings will be mutated to set runAsNonRoot=true, thus requiring a defined non-zero numeric USER directive in the container. No default provided. Setting allowPrivilegeEscalation=false is strongly recommended with this strategy.

因此，当您希望以非 super 用户身份启动容器时， USER directive很重要。