<p>I've built a docker image based on <a href="https://hub.docker.com/_/httpd" rel="nofollow noreferrer">httpd:2.4</a>. In my k8s deployment I've defined the following <code>securityContext</code>:</p>

<pre><code>securityContext:
  privileged: false
  runAsNonRoot: true
  runAsUser: 431
  allowPrivilegeEscalation: false
</code></pre>

<p>When I apply the deployment without this <code>securityContext</code> everything works fine, the server starts up correctly, etc. However when I add in the above <code>securityContext</code> my pod has the status <code>CrashLoopBackOff</code> and I get the following from <code>$ kubectl logs...</code></p>

<pre><code>(13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
AH00015: Unable to open logs
</code></pre>

<p>From searching around online I've found that this is because apache needs to be root in order to run, so running as non-root will fail.</p>

<p>I've also found that <code>httpd.conf</code> has the following</p>

<pre><code>#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.  
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User daemon
Group daemon
</code></pre>

<p>Which seems to suggest that if I don't use <code>runAsNonRoot</code> or <code>runAsUser</code> in <code>securityContext</code> it should automatically switch to whichever user I specify in <code>httpd.conf</code>. In my case I created a user/group <code>swuser</code> and edited <code>httpd.conf</code> accordingly. However when I run the image locally with <code>docker run -p 5000:80 my-registry/my-image:1.0.12-alpha</code> and then run <code>docker exec -it my-container whoami</code> it prints <code>root</code>.</p>

<p>So my question is, what can I do to run my container safely as non-root in k8s (and be sure it is non-root)</p>

<p>Run the apache on a port greater than 1024. </p>

<p>Ports below 1024 are privileged ports only available to the root user.</p>

<p>As you will have some ingress load balancer before that, it shouldn't matter :-)</p>
