<p>I am testing with securityContext but I cant start a pod when I set runAsNonRoot to true.
I use vagrant to deploy a master and two minions and ssh to the host machine as the user abdelghani :</p>
<pre><code>id $USER
uid=1001(abdelghani) gid=1001(abdelghani) groups=1001(abdelghani),27(sudo)
</code></pre>
<p>Cluster information:</p>
<p>Kubernetes version: 4.4.0-185-generic
Cloud being used: (put bare-metal if not on a public cloud)
Installation method: manual
Host OS: ubuntu16.04.6
CNI and version:
CRI and version:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: buggypod
spec:
  containers:
  - name: container
    image: nginx
    securityContext:        
      runAsNonRoot: true
</code></pre>
<p>I do :
kubectl apply -f pod.yml
it says pod mybugypod created but when I check with :
kubectl get pods
the pod’s status is CreateContainerConfigError</p>
<p>what is it I am doing wrong?</p>

<p>I try to run the pod based on your requirement. And the reason it failed is the Nginx require to modify some configuration in /etc/ owned by root and when you runAsNonRoot it fails as it cannot edit the Nginx default config.</p>
<p>This is the error  you actually get when you run it.</p>
<pre><code>10-listen-on-ipv6-by-default.sh: error: can not modify /etc/nginx/conf.d/default.conf (read-only file system?)
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2020/08/13 17:28:55 [warn] 1#1: the &quot;user&quot; directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
nginx: [warn] the &quot;user&quot; directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
2020/08/13 17:28:55 [emerg] 1#1: mkdir() &quot;/var/cache/nginx/client_temp&quot; failed (13: Permission denied)
nginx: [emerg] mkdir() &quot;/var/cache/nginx/client_temp&quot; failed (13: Permission denied)
</code></pre>
<p>The spec I ran.</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: buggypod
  name: buggypod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
  containers:
  - image: nginx
    name: buggypod
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

</code></pre>
<p>My suggestion is you create a custom Nginx image with a Dockerfile that also creates user and provides permissions to the folders /var/cache/nginx, /etc/nginx/conf.d, /var/log/nginx for the newly created user. Such that you achieve running the container as Non-Root.</p>
