<p>Having this dockerfile:</p>

<pre><code>FROM debian:stretch
CMD ["cat", "/tmp/secrets.txt"]
</code></pre>

<p>I can then run</p>

<pre><code>docker run -v /etc/shadow:/tmp/secrets.txt spycontainer
</code></pre>

<p>Even if I am not root, I will be able to see <code>/etc/shadow</code> ! </p>

<p>How is Kubernetes avoiding somebody doing this? Do I need to make sure that every image has the UID in the dockerfile??</p>

Carlos Garcia
<p>In kubernetes you can use <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod" rel="nofollow noreferrer">pod security context</a></p>

<p>When you run a container without any security context, the entrypoint command with run as <strong>root</strong>. For example</p>

<pre><code>$ kubectl run -i --tty busybox --image=busybox --restart=Never -- sh
/ # ps aux
PID   USER     TIME  COMMAND
    1 root      0:00 sh
</code></pre>

<p>If you use security context like following</p>

<pre><code>spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
</code></pre>

<p>Using <code>runAsUser</code> you can modify the user id of the process inside a container. For example</p>

<pre><code>$ kubectl apply -f https://k8s.io/examples/pods/security/security-context.yaml
$ kubectl exec -it security-context-demo -- sh
/ $ ps aux
PID   USER     TIME  COMMAND
    1 1000      0:00 sleep 1h
    6 1000      0:00 sh

</code></pre>
