Unable to deploy image into GKE cluster

Question

I have created a docker image locally and pushed it to GCP container registry using gcloud sdk. The image is successfully pushed to container registry.

Now, I am trying to manually deploy this image from the container registry on to the existing private GKE cluster from the GCP UI by selecting Deploy to GKE option. After deploying, I am getting an error saying "container has runasNonRoot and the image will run as root (pod:"appname-XXXXX_default(XXXXXX-XXXX....)", container:appName-1): CreateContainerConfigError " Any help will be greatly appreciated.

Answer 1

Sounds like you've got a pod security policy setup to avoid running containers as root. This is a good security policy because of the risk of breakout into other applications or nodes within the cluster.

You might want to read up on the Kubernetes security context and potentially rebuild your container.

With my clusters I would often have to consume public images that use root, in this case I would consume the previous image as a base, create a new (non-root) user and new group to take ownership of any tools that are needed in the image.

Changing the default user in a Dockerfile:

FROM ubuntu


RUN groupadd --gid 15555 notroot \ 
    && useradd --uid 15555 --gid 15555 -ms /bin/false notroot\
    && chown -R notroot:notroot /home/notroot

USER notroot

ENTRYPOINT ["/bin/bash", "-c"]
CMD ["whoami && id"]

Here's a better explanation of why you should avoid root in Docker images.