<p>I have docker image with custom user (for example tod). I want to find out information about this user without creating a container.</p>
<p>Base image: centos8</p>
<p>UPD: A little about context.
I run an unprivileged container in k8s and get the following error:
<code>container has runAsNonRoot and image has non-numeric user (tod), cannot verify user is non-root</code></p>
<p>I read <a href="https://stackoverflow.com/questions/49720308/kubernetes-podsecuritypolicy-set-to-runasnonroot-container-has-runasnonroot-and">this</a> answer and cannot understand why it is not possible to get the user id from my container.</p>

<p>Lets try to analyze the following code:</p>
<p><a href="https://github.com/kubernetes/kubernetes/blob/cea1d4e20b4a7886d8ff65f34c6d4f95efcb4742/pkg/kubelet/kuberuntime/security_context_others.go#L47-L48" rel="nofollow noreferrer">github code reference link</a></p>
<pre><code>case uid == nil &amp;&amp; len(username) &gt; 0:
    return fmt.Errorf(&quot;container has runAsNonRoot and image has non-numeric user (%s), cannot verify user is non-root (pod: %q, container: %s)&quot;, username, format.Pod(pod), container.Name)
</code></pre>
<p>This is the code that print the error you see. You see the error because <code>uid == nil</code> and at the same time <code>username != &quot;&quot;</code>.</p>
<p>But why username has value and uid does not? Why couldn't they both have value?</p>
<p>It turns out that they couldn't because UID and the username are mutually exclusive. Have a look at the description of these parameters:</p>
<p><a href="https://github.com/kubernetes/kubernetes/blob/3895b1e4a0f8044540365a5a0a086cba0af77340/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go#L5158-L5164" rel="nofollow noreferrer">github code reference link</a>:</p>
<pre><code>// UID that will run the command(s). This is used as a default if no user is
// specified when creating the container. UID and the following user name
// are mutually exclusive.
Uid *Int64Value `protobuf:&quot;bytes,5,opt,name=uid,proto3&quot; json:&quot;uid,omitempty&quot;`
// User name that will run the command(s). This is used if UID is not set
// and no user is specified when creating container.
Username string `protobuf:&quot;bytes,6,opt,name=username,proto3&quot; json:&quot;username,omitempty&quot;`
</code></pre>
<p>So turns out it's not a bug. It's just how the container runtime interface standard got designed, and you can't do much about it.</p>
<hr />
<p>What you could do is change the way you use <a href="https://docs.docker.com/engine/reference/builder/#user" rel="nofollow noreferrer">USER instruction in Dockerfile</a>.</p>
<p>Instead of using username with USER instruction, create a user with a known uid and use this uid instead, like in example below:</p>
<pre><code>RUN useradd -r -u 1001 appuser
USER 1001
</code></pre>
