<p>I have a pod and NodePort service running on GKE.</p>
<p>In the Dockerfile for the container in my pod, I'm using <code>gosu</code> to run a command as a specific user:</p>
<p>startup.sh</p>
<pre><code>exec /usr/local/bin/gosu mytestuser &quot;$@&quot;
</code></pre>
<p>Dockerfile</p>
<pre><code>FROM ${DOCKER_HUB_PUBLIC}/opensuse/leap:latest

# Download and verify gosu
RUN gpg --batch --keyserver-options http-proxy=${env.HTTP_PROXY} --keyserver hkps://keys.openpgp.org \
      --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 &amp;&amp; \
    curl -o /usr/local/bin/gosu -SL &quot;https://github.com/tianon/gosu/releases/download/1.12/gosu-amd64&quot; &amp;&amp; \
    curl -o /usr/local/bin/gosu.asc -SL &quot;https://github.com/tianon/gosu/releases/download/1.12/gosu-amd64.asc&quot; &amp;&amp; \
    gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu &amp;&amp; \
    chmod +x /usr/local/bin/gosu

# Add tini
ENV TINI_VERSION v0.18.0
ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
RUN chmod +x /tini
ENTRYPOINT [&quot;/tini&quot;, &quot;--&quot;, &quot;/startup/startup.sh&quot;]

# Add mytestuser
RUN useradd mytestuser

# Run startup.sh which will use gosu to execute following `CMD` as `mytestuser`
RUN /startup/startup.sh
CMD [&quot;java&quot;, &quot;-Djava.security.egd=file:/dev/./urandom&quot;, &quot;-jar&quot;, &quot;/helloworld.jar&quot;]
</code></pre>
<p>I've just noticed that when I log into the container on GKE and look at the processes running, the java process that I would expect to be running as <code>mytestuser</code> is actually running as <code>chronos</code>:</p>
<pre><code>me@gke-cluster-1-default-ool-1234 ~ $ ps aux | grep java
root        9551  0.0  0.0   4296   780 ?        Ss   09:43   0:00 /tini -- /startup/startup.sh java -Djava.security.egd=file:/dev/./urandom -jar /helloworld.jar
chronos     9566  0.6  3.5 3308988 144636 ?      Sl   09:43   0:12 java -Djava.security.egd=file:/dev/./urandom -jar /helloworld.jar

</code></pre>
<p>Can anyone explain what's happening, i.e. who is the <code>chronos</code> user, and why my process is not running as <code>mytestuser</code>?</p>

<p>When you run a useradd inside the container (or as part of the image build), it adds am entry to the <code>/etc/passwd</code> <em>inside the container</em>. The uid/gid will be in a shared namespace with the host, unless you enable user namespaces. However the mapping of those ids to names will be specific to the filesystem namespace where the process is running. Therefore in this scenario, the uid of mytestuser inside the container happens to be the same uid as chronos on the host.</p>
