<p>We’ve been planning for a long time to introduce <code>securityContext: runAsNonRoot: true</code> as a requirement to our pod configurations for a while now.</p>

<p>Testing this today I’ve learnt that since <code>v1.8.4</code> (I think) you also have to specify a particular UID for the user running the container, e.g <code>runAsUser: 333</code>.</p>

<p>This means we not only have to tell developers to ensure their containers don’t run as root, but also specify a specific UID that they should run as, which makes this significantly more problematic for us to introduce.</p>

<p>Have I understood this correctly? What are others doing in this area? To leverage <code>runAsNonRoot</code> is it now required that Docker containers run with a specific and known UID?</p>

<p>The Kubernetes Pod SecurityContext provides two options <code>runAsNonRoot</code> and <code>runAsUser</code> to enforce non root users. You can use both options separate from each other because they test for different configurations.  </p>

<p>When you set <code>runAsNonRoot: true</code> you require that the container will run with a user with any UID other than 0. No matter which UID your user has.<br>
When you set <code>runAsUser: 333</code> you require that the container will run with a user with UID 333. </p>
