<p>I want to run the container under a <code>nonroot</code> user (username already exists) from Java image: <a href="https://console.cloud.google.com/gcr/images/distroless/GLOBAL/java@sha256:34c3598d83f0dba27820323044ebe79e63ad4f137b405676da75a3905a408adf/details?tag=8" rel="nofollow noreferrer">gcr.io/distroless/java:8</a>. This user is already present in the image and I've added a command to the Dockerfile: <code>USER nonroot</code></p>
<p>Now I want to add it to the K8s manifest file, which requires UID/GID only (not literal username):</p>
<pre><code>  securityContext:
    runAsUser: &lt;USER_ID&gt;
    runAsGroup: &lt;GROUP_ID&gt;
    runAsNonRoot: true
</code></pre>
<p>So, the question is how to get <code>nonroot</code> user's ID and group's ID from the distroless image (no shell inside)?</p>
<p>If I don't add anything to the manifest file, the container starts with user <code>nonroot</code> (seen in logs). Does it mean that that root isn't used anymore (and is enough for the container's security)?</p>
<p>UPDATE:</p>
<p>Adding only <code>run_as_non_root = true</code> to the Kubernetes' deployment  manifest file works fine, but in Terraform configuration file there is already present <code>fs_group = 1234</code>, which also automatically adds:</p>
<pre><code>run_as_group = 0
run_as_user  = 0
</code></pre>
<p>It makes the pod to fails with the error <code>Error: container's runAsUser breaks non-root policy</code>.
Setting nonroot's ID/GID would fix this problem, but how can I get these values ID from the distroless java image?</p>

fireman777
<p>If you don't add anything to the Kubernetes manifest, then the container will run as the <code>USER</code> declared in the Dockerfile.  Unless you specifically need to force the container to run as some other user ID, this is probably fine.</p>
<pre class="lang-yaml prettyprint-override"><code>securityContext:
  runAsNonRoot: true
  # but don't usually need to specific specific uid/gid
</code></pre>
<p>A well-designed image will also be able to tolerate running as an arbitrary user.  If it doesn't write files at all, or only writes into world-writable directories like <code>/tmp</code> and to storage directories it specifically expects to have mounted from outside the container, then it doesn't really matter if the numeric user ID &quot;exists&quot; inside the container at all, and you can choose any user ID you want here.</p>
<pre class="lang-yaml prettyprint-override"><code>securityContext:
  runAsUser: 9876  # or anything else that's not 0
  runAsGroup: 9876
</code></pre>
