3 ms·
I was wondering how they enforce it. >OpenShift runs whichever container you want with a random UUID, so unless the Docker image is prepared to work as a non-r
by captn3m0 9y ago
I was wondering how they enforce it.
>OpenShift runs whichever container you want with a random UUID, so unless the Docker image is prepared to work as a non-root user, it probably won't work due to permissions issues.
Source: https://engineering.bitnami.com/articles/running-non-root-containers-on-openshift.html https://engineering.bitnami.com/articles/running-non-root-co...
- robszumski 9y agoIt's enforced with a default PodSecurityPolicy, which describes the attributes/capabilities that containers can have on the cluster.
- smarterclayton 9y agoIt’s not quite random. Every namespace gets assigned a unique block of 10k UIDs and the default container UID is the first in the block for all unprivileged users. Granting access to a higher powered PSP (actually a security context constraint which was the basis for PSP) changes the defaulting.