Skip to content

Build Openshift rootless UBI images

For #27126 (closed) we need to build images that cannot be run as root.

OpenShift runs the container with a different user id each time. We need to:

  • Specify a default user that isn't 0(root) - most commonly 1001
  • Allow the root group to read/write to each directory in which our image might read/write. This is safe because each random user is part of the root group but the root group doesn't have any special privileges

Resources:

https://docs.openshift.com/container-platform/3.11/creating_images/guidelines.html#:~:text=Support%20Arbitrary%20User%20IDs,permissions%20on%20the%20host%20node.