0

Given following AKS advisor recommendation "Running containers as root user should be avoided" with following remediation step:

  • For these pods, add rule: 'MustRunAsNonRoot' in a runAsUser section of the container's spec.

I should note here that MustRunAsNonRoot is part of PodSecurityPolicy, which should not be used anymore with AKS, as noted in How to enforce MustRunAsNonRoot policy in K8S cluster in AKS

I added runAsNonRoot: true to the pod's securityContext:

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    ...
  creationTimestamp: "2021-09-28T14:02:34Z"
  generation: 13
  labels:
    app.kubernetes.io/managed-by: Helm
  name: my-service
  namespace: my-namespace
  resourceVersion: "..."
  uid: ...
spec:
  replicas: 1
  ...
  template:
    metadata:
      ...
    spec:
      securityContext:
        runAsNonRoot: true

... but the resource is still being listed for this recommendation. What do I miss here, what should I change in order to fulfill this recommendation?

sl3dg3
  • 5,026
  • 12
  • 50
  • 74

1 Answers1

0

Bridgecrew has defined several policies that enforce best practices when it comes to k8s deployments in production. You can verify your deployment configurations with the ones mentioned in those policies.

BC_K8S_22 and BC_K8S_37 are some of the policies that are related to containers, root users and their privileges.

The following are some of the configs you can include to adhere to the deployment best practices. You should go through all their policies and use the ones that best apply to your use case.

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  runAsUser: 10500
  runAsGroup: 10500
RrR-
  • 1,251
  • 3
  • 15
  • 32
  • Well, I have set `runAsNonRoot: true`, and user/group is managed within docker file (has to be, or the container would not start anymore). Therefore I can't see why it is not fulfilled. – sl3dg3 Sep 30 '21 at 12:54
  • bcs when the container image is build to with `UID 0` it is still root. You would need both settings: `runAsNonRoot: true` & `runAsUser: 1001`. You can read here further: https://snyk.io/blog/10-kubernetes-security-context-settings-you-should-understand/ – Philip Welz Oct 01 '21 at 22:45
  • important: when you define the default user that will be used in the running container via `USER` command in your Dockerfile make sure to use the UID of that user (not the username!). – Tommy Brettschneider Mar 10 '22 at 08:17