<p>l want to launch a container with non-root user, but l cannot modify the origin Dockerfile, Or l know l can do something like <code>Run useradd xx</code> then <code>User xx</code> in Dockerfile to achieve that.
What l am doing now is modifying the yaml file like the following:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-pod
    image: xxx
    command:
        - /bin/sh
        - -c
        - |
          useradd xx -s /bin/sh;
          su -l xx; // this line is not working
          sleep 1000000;

</code></pre>
<p>when l exec into the pod, the default is still the root user, anyone can help with that? Thanks in advance!</p>

Rosmee
<p>+1 to <a href="https://stackoverflow.com/a/64708860/7108457">dahiya_boy's</a> answer however I'd like to add also my 3 cents to what was already said.</p>
<p>I've reproduced your case using popular <code>nginx</code> image. I also modified a bit commands from your example so that home directory for the user <code>xxx</code> is created as well as some other commands for debugging purpose.</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-pod
    image: nginx
    command:
        - /bin/sh
        - -c
        - |
          useradd xxx -ms /bin/bash;
          su xxx &amp;&amp; echo $?;
          whoami;
          sleep 1000000;
</code></pre>
<p>After successfully applying the above <code>yaml</code> we can run:</p>
<pre><code>$ kubectl logs my-pod
0
root
</code></pre>
<p>As you can see the exit status of the <code>echo $?</code> command is <code>0</code> which means that previous command in fact ran successfully. Even more: the construction with <code>&amp;&amp;</code> implies that second command is run if and only if the first command completed successfully (with exit status equal to <code>0</code>). If <code>su xxx</code> didn't work, <code>echo $?</code> would never run.</p>
<p>Nontheless, the very next command, which happens to be <code>whoami</code>, prints the actual user that is meant to run all commands in the container and which was defined in the original image. So no matter how many times you run <code>su xxx</code>, all subsequent commands will be run as user <code>root</code> (or another, which was defined in the <code>Dockerfile</code> of the image). So basically the only way to override it on kubernetes level is using already mentioned <code>securityContext</code>:</p>
<blockquote>
<p>You need to use security context as like below</p>
<pre><code>   securityContext:
     runAsUser: 1000
     runAsGroup: 3000
     fsGroup: 2000
</code></pre>
</blockquote>
<p>However I understand that you cannot use this method if you have not previously defined your user in a custom image. This can be done if a user with such <code>uid</code> already exists.</p>
<p>So to the best of my knowledge, it's impossible to do this the way you presented in your question and it's not an issue or a bug. It simply works this way.</p>
<p>If you <code>kubectl exec</code> to your newly created <code>Pod</code> in the interactive mode, you can see that everything works perfectly, user was successfully added and you can switch to this user without any problem:</p>
<pre><code>$ kubectl exec -ti my-pod -- /bin/sh
# tail -2 /etc/passwd
nginx:x:101:101:nginx user,,,:/nonexistent:/bin/false
xxx:x:1000:1000::/home/xxx:/bin/bash
# su xxx
xxx@my-pod:/$ pwd
/
xxx@my-pod:/$ cd
xxx@my-pod:~$ pwd
/home/xxx
xxx@my-pod:~$ whoami
xxx
xxx@my-pod:~$
</code></pre>
<p>But it doesn't mean that by running <code>su xxx</code> as one of the commands, provided in a <code>Pod</code> <code>yaml</code> definition, you will permanently change the default user.</p>
<p>I'd like to emphasize it again. In your example <code>su -l xxx</code> runs successfully. It's not true that it doesn't work. In other words: 1. container is started as user <code>root</code> 2. user <code>root</code> runs <code>su -l xxx</code> and once completed successfully, exits 3. user <code>root</code> runs <code>whoami</code>.</p>
<p>So the only reasonable solution is, already mentioned by @dahiya_boy, adding an extra layer and create a custom image.</p>
<p>As to:</p>
<blockquote>
<p>@Rosmee YOu can add new docker image layer. and use that image in your
kubernetes. – dahiya_boy 18 hours ago</p>
<p><strong>yes l know that, but as i said above, l cannot modify the original
image</strong>, l need to switch user dynamically – Rosmee 17 hours ago</p>
</blockquote>
<p>You say <em>&quot;I cannot modify the original image&quot;</em> and this is exactly what custom image is about. No one is talking here about modifying the original image. It remains untouched. By writing your own <code>Dockerfile</code> and e.g. by adding in it an extra user and setting it as a default one, you don't modify the original image at all, but build a new custom image on top of it. That's how it works and that's the way it is meant to be used.</p>
