<p>I am trying to find out in which user's context do the containers run and looking for a way to get this data without exec into each container. Since I am working on a cluster with many pods, it is nearly impossible to go inside each container and get the user.</p>
<p>Is there a command that I can use for this?</p>

SeattleOrBayArea
<p>You can use <a href="https://falco.org" rel="nofollow noreferrer">Falco</a> for this.Falco communicates with the provided K8s API server to decorate events with the K8s pod/namespace/deployment/etc. associated with the event. Below is an example of Falco alerts from <a href="https://falco.org/docs/alerts/formatting/" rel="nofollow noreferrer">here</a>. You can see <code>user=root</code></p>
<pre><code>output: &quot;Namespace change (setns) by unexpected program (user=%user.name command=%proc.cmdline parent=%proc.pname %container.info)&quot;

$ falco
15:42:35.347416068: Warning Namespace change (setns) by unexpected program (user=root command=test_program parent=hyperkube k8s-kubelet (id=4a4021c50439))

$ falco -pk -k &lt;k8s api server url&gt;
15:42:35.347416068: Warning Namespace change (setns) by unexpected program (user=root command=test_program parent=hyperkube k8s.pod=jclient-3160134038-qqaaz container=4a4021c50439)

$ falco -p &quot;This is Some Extra&quot; -k &lt;k8s api server url&gt;
15:42:35.347416068: Warning Namespace change (setns) by unexpected program (user=root command=test_program parent=hyperkube k8s-kubelet (id=4a4021c50439)) This is Some Extra
</code></pre>
