What is Kubernetes Pod Security Context NonRoot?

Question

Accepted Answer

**runAsNonRoot** — prevent containers from running as root.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nonroot-app
spec:
  replicas: 3
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 3000
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: app
        image: nginx:latest
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        volumeMounts:
        - name: tmp
          mountPath: /tmp
      volumes:
      - name: tmp
        emptyDir: {}
```

```bash
kubectl get deployment nonroot-app -o jsonpath='{.spec.template.spec.securityContext.runAsNonRoot}'
kubectl exec deployment/nonroot-app -- id
kubectl exec deployment/nonroot-app -- whoami
kubectl exec deployment/nonroot-app -- cat /proc/1/status | grep Cap
```

**Behavior:**
- Container image must define non-root user.
- If not, container will fail to start.
- Required by restricted PSS profile.

**Best Practices:**
- Set runAsNonRoot: true at Pod and container level.
- Use non-root user in Dockerfile (USER directive).
- Verify with kubectl exec -- id.

DevOps: What is Kubernetes Pod Security Context NonRoot?