Non-Root container false positive about kubescape HOT 5 CLOSED

Thank you for reporting this.
@YiscahLevySilas1 can you please take a look?

from kubescape.

Hi @jankoh ,
AFAIU, the runAsNonRoot field affects the UID but not the GID, so even if runAsNonRoot is true it would still be best practice to define runAsGroup explicitly. From the k8s documentation:
runAsNonRoot (boolean): Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

I agree that our remediation does not reflect that, wdyt about the following suggestion?
Remediation
If your application does not need root privileges, make sure to define runAsNonRoot as true or explicitly set the runAsUser using ID 1000 or higher under the PodSecurityContext or container securityContext. In addition, set an explicit value for runAsGroup using ID 1000 or higher.

from kubescape.

@YiscahLevySilas1 I think that change whould make it clear what needs to be done to prevent the finding. Thank you! 😃

from kubescape.

Great - thanks for reporting, I'll update the remediation

from kubescape.

Resolved in regolibrary PR #585

from kubescape.