Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

runAsNonRoot: true doesn't work if your container image uses a non-numeric UID. #85

danderson opened this issue Dec 16, 2017 · 2 comments


Copy link

Is this a bug report or a feature request?:


What happened:

I embarrassingly discovered that metallb 0.2.0 is broken. The manifests as configured cannot start either controller or bgp-speaker, because they require runAsNonRoot, and apparently k8s cannot verify that "nobody" is non-root because it's not a numeric UID.

What you expected to happen:

MetalLB 0.2.0 should work :(

How to reproduce it (as minimally and precisely as possible):

Try to apply the MetalLB manifests from the website.

@danderson danderson added the bug label Dec 16, 2017
@danderson danderson self-assigned this Dec 16, 2017
danderson added a commit that referenced this issue Dec 16, 2017
Fixes #85. By "fix" I mean we just un-harden the container. This is
just a hotfix for 0.2.1, in 0.3 we'll have all the hardening figured out
again after arp-speaker et al. are all merged.
Copy link
Contributor Author

Fixed in 0.2.1. Master is probably still broken, but master is completely broken right now anyway because of the chaos from the speaker merge. There's #53 open to track the re-hardening of all containers post-merge.

Copy link

miekg commented Dec 16, 2017 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

2 participants