Skip to content

Conversation

@candrews
Copy link
Contributor

Description

Systems configured to disallow running images as root aren't able to run images that use user name string values for the USER because they can't validate that a named user isn't root. To allow images to run on such systems, use the uid of the user as the value for USER instead of the username.

See: kubernetes/kubernetes#56503

Motivation and Context

The current advice is to use USER node which won't work on k8s clusters configured with MustRunAsNonRoot. By changing that advice to use the uid instead of the username, images will run with MustRunAsNonRoot.

Testing Details

Example Output(if appropriate)

Types of changes

  • Documentation
  • Version change (Update, remove or add more Node.js versions)
  • Variant change (Update, remove or add more variants, or versions of variants)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Other (none of the above)

Checklist

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING.md document.
  • All new and existing tests passed.

Systems configured to disallow running images as root aren't able to run images that use user name string values for the `USER` because they can't validate that a named user isn't root. To allow images to run on such systems, use the uid of the user as the value for `USER` instead of the username.

See: kubernetes/kubernetes#56503
Copy link
Member

@SimenB SimenB left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes sense, thanks!

@SimenB SimenB merged commit 4e29b63 into nodejs:main Jan 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants