<p>Openshift cluster is installed using this doc: <a href="https://docs.openshift.com/container-platform/4.5/installing/installing_aws/installing-aws-default.html" rel="nofollow noreferrer">https://docs.openshift.com/container-platform/4.5/installing/installing_aws/installing-aws-default.html</a>
When running a pod in any project - it is always started with the same UID 101:</p>
<pre><code>$  oc run -it -n knative-serving --image busybox test1 sh
If you don't see a command prompt, try pressing enter.
~ $ id
uid=101(101) gid=0(root) groups=1000600000
</code></pre>
<p>This is a problem when user 101 already exist in an image - in this case it has a GID 101 as well, which prevents from accessing FS (fs permissions are for GID 0).</p>
<pre><code>$  oc run -it -n kaiburr-app --image registry.kaiburr.com/dynamic-analysis-worker test3 sh
id
If you don't see a command prompt, try pressing enter.
id
uid=101(systemd-timesync) gid=101(systemd-timesync) groups=101(systemd-timesync),1000630000
$ ls -ld
drwxrwxr-x. 1 zap root 4096 Oct 19 19:24 .
$ touch test
touch: cannot touch 'test': Permission denied
$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:101:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:105::/nonexistent:/usr/sbin/nologin
zap:x:1000:1000::/home/zap:/bin/bash
</code></pre>
<p>Expected behavior is that containers are created with UID from a project's range and GID 0.</p>
<p>Openshift is updated to the latest version: 4.5.14</p>
<p>EDIT: found an offending SCC, created by a nginx-ingress operator</p>
<pre><code>$ oc get scc nginx-ingress-scc -o yaml
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities:
- NET_BIND_SERVICE
fsGroup:
  type: MustRunAs
groups:
- system:authenticated
kind: SecurityContextConstraints
metadata:
  creationTimestamp: &quot;2020-09-29T04:19:43Z&quot;
  generation: 5
  managedFields:
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:allowHostDirVolumePlugin: {}
      f:allowHostIPC: {}
      f:allowHostNetwork: {}
      f:allowHostPID: {}
      f:allowHostPorts: {}
      f:allowPrivilegeEscalation: {}
      f:allowPrivilegedContainer: {}
      f:allowedCapabilities: {}
      f:defaultAddCapabilities: {}
      f:fsGroup:
        .: {}
        f:type: {}
      f:priority: {}
      f:readOnlyRootFilesystem: {}
      f:requiredDropCapabilities: {}
      f:runAsUser:
        .: {}
        f:type: {}
      f:seLinuxContext:
        .: {}
        f:type: {}
      f:supplementalGroups:
        .: {}
        f:type: {}
      f:users: {}
      f:volumes: {}
    manager: nginx-ingress-operator
    operation: Update
    time: &quot;2020-09-29T04:26:51Z&quot;
  - apiVersion: security.openshift.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:groups: {}
      f:runAsUser:
        f:uid: {}
    manager: oc
    operation: Update
    time: &quot;2020-10-21T23:10:00Z&quot;
  name: nginx-ingress-scc
  resourceVersion: &quot;17079015&quot;
  selfLink: /apis/security.openshift.io/v1/securitycontextconstraints/nginx-ingress-scc
  uid: ffe0c34c-9fe4-4cf6-9d57-eb919c90d42a
priority: 20
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: MustRunAs
  uid: 101
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: MustRunAs
users:
- ingress-nginx:my-nginx-ingress-controller
volumes:
- secret
</code></pre>
<p>When I edited this SCC and changed UID to 102 - all new pods were now created with UID 102. I noticed that this SCC had priority 20, but anyuid SCC had 10. I set the priority of that nginx SCC to 5 and the UID behavior is now seems to be anyuid (probably, because I am running everything as a default temporary admin), no UID 101 any more!</p>

Oleg Khaschansky
<p>Usually anything uid related is configured by SCC in openshift, you can always use <code>oc describe scc</code> to see if any SCC is affecting your user.</p>
<p>EDIT by OP: more details on the solution of a problem can be found in the question itself.</p>
