<p>What is the difference between selecting the user to run as in the <code>securityContext.runAsUser</code> section of my k8s deployment, vs specifying the user using <code>USER myuser</code> in the Dockerfile? </p>

<p>I'm particularly interested in if there are security concerns associated with <code>USER myuser</code> that don't exist under <code>securityContext</code></p>

<h3>MustRunAsNonRoot</h3>

<p><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups" rel="nofollow noreferrer">Users and groups</a></p>

<blockquote>
  <p>Requires that the pod be submitted with a <code>non-zero runAsUser</code> or have the <code>USER directive defined</code> (using a numeric UID) in the image.
  Pods which have specified neither runAsNonRoot nor runAsUser settings
  will be mutated to set <code>runAsNonRoot=true</code>, thus requiring a defined
  <code>non-zero numeric USER directive</code> in the container. No default
  provided. Setting allowPrivilegeEscalation=false is strongly
  recommended with this strategy.</p>
</blockquote>

<p>So <code>USER directive</code> is important when you want the container to be started as non-root.</p>
