{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11669","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11669/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11669/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11669/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/11669","id":96372670,"number":11669,"title":"add non-root directive to SC and kubelet checking","user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/cla:%20yes","name":"cla: yes","color":"bfe5bf"}],"state":"open","locked":false,"assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2015-07-21T17:30:37Z","updated_at":"2015-07-21T21:06:06Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/pulls/11669","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/11669","diff_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/11669.diff","patch_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/11669.patch"},"body":"Currently a SecurityContext allows you to set the preferred user to run an image.  In some cases it is preferable to not specify the user and allow the system or image to provide the user.  Based on work in https://github.com/GoogleCloudPlatform/kubernetes/pull/7893 it was found that, when dealing with non-root security policies, there must be a way to account for when an image specifies a user but the container's `runAsUser` is not set.\r\n\r\nThe easiest way to deal with this seems to be allowing the pod to be submitted but having a final check in the kubelet (docker manager).  In order to accomplish this there should be a marker to say that the effective context is expecting to run as non-root.  This allows the kubelet's image implementations to know that in the absence of a `runAsUser` they must ensure that the image being run has a non-root user directive.\r\n\r\nNote: currently there is an admission controller that prevents the use of `runAsUser` in Kubernetes so this should not change the current system behavior.\r\n\r\n@erictune @pmorie @smarterclayton "},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/123476935","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/pull/11669#issuecomment-123476935","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/11669","id":123476935,"user":{"login":"pweil-","id":5230419,"avatar_url":"https://avatars.githubusercontent.com/u/5230419?v=3","gravatar_id":"","url":"https://api.github.com/users/pweil-","html_url":"https://github.com/pweil-","followers_url":"https://api.github.com/users/pweil-/followers","following_url":"https://api.github.com/users/pweil-/following{/other_user}","gists_url":"https://api.github.com/users/pweil-/gists{/gist_id}","starred_url":"https://api.github.com/users/pweil-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pweil-/subscriptions","organizations_url":"https://api.github.com/users/pweil-/orgs","repos_url":"https://api.github.com/users/pweil-/repos","events_url":"https://api.github.com/users/pweil-/events{/privacy}","received_events_url":"https://api.github.com/users/pweil-/received_events","type":"User","site_admin":false},"created_at":"2015-07-21T21:06:06Z","updated_at":"2015-07-21T21:06:06Z","body":"@pmorie - uid:gid string check added in feedback commit"}}