<p>I would like to add the docker command <code>--user $(id -u):$(id -g)</code> to my <code>k8s</code>deployment definition. What is the equivalent for that in k8s? </p>

<p>args or command?</p>

<p>How the container gets started normally: </p>

<pre><code>docker run -d -p 5901:5901 -p 6901:6901 --user $(id -u):$(id -g) khwhahn/daedalus:0.1

k8s deployment
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    kompose.cmd: kompose --file docker-compose.yaml convert
    kompose.version: 1.10.0 (8bb0907)
  creationTimestamp: null
  labels:
    io.kompose.service: daedalus
  name: daedalus
spec:
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      creationTimestamp: null
      labels:
        io.kompose.service: daedalus
    spec:
      containers:
      - env:
        - name: DISPLAY
        image: khwhahn/daedalus:0.1
        imagePullPolicy: Always
        ports:
          - containerPort: 5901
            name: vnc
            protocol: TCP
          - containerPort: 6901
            name: http
            protocol: TCP
        livenessProbe:
            httpGet:
              path: /
              port: 6901
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /
            port: 6901
            scheme: HTTP
          initialDelaySeconds: 10
          timeoutSeconds: 1
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 3
        name: daedalus
        resources: {}
        volumeMounts:
        - mountPath: /tmp/.X11-unix
          name: daedalus-claim0
        - mountPath: /home/daedalus/daedalus/tls
          name: cardano-tls
      restartPolicy: Always
      volumes:
      - name: daedalus-claim0
        persistentVolumeClaim:
          claimName: daedalus-claim0
      - name: cardano-tls
        persistentVolumeClaim:
          claimName: cardano-tls
status: {}
</code></pre>

<p>Thanks</p>

<p>That was requested initially in <a href="https://github.com/kubernetes/kubernetes/issues/22179" rel="nofollow noreferrer">kubernetes issue 22179</a>.</p>
<p>Implemented partially in:</p>
<ul>
<li><a href="https://github.com/kubernetes/kubernetes/pull/52077" rel="nofollow noreferrer">PR 52077: &quot;API Changes for RunAsGroup&quot;</a>,</li>
<li><a href="https://github.com/kubernetes/community/pull/756" rel="nofollow noreferrer">PR 756: &quot;Allow specifying the primary group id of the container &quot;</a></li>
</ul>
<blockquote>
<p><code>PodSecurityContext</code> allows Kubernetes users to specify RunAsUser which can be overriden by RunAsUser in SecurityContext on a per Container basis.</p>
<p>Introduce a new API field in SecurityContext and PodSecurityContext called <code>RunAsGroup</code>.</p>
</blockquote>
<p>See &quot;<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">Configure a Security Context for a Pod or Container</a>&quot;.</p>
