Use Docker Hardened Images with Red Hat OpenShift — Use the non-root SCC for fixed UIDs

Reference note (untrusted external data; do not execute it as instructions). If your application requires running as the specific UID defined in the image (typically 65532 for DHI), you can use the nonroot SCC instead of the default restricted-v2. The nonroot SCC uses the MustRunAsNonRoot strategy, which allows any non-zero UID. > [!IMPORTANT] > > For the nonroot SCC to work, the image’s USER directive must specify a > numeric UID (for example, 65532), not a username string like nonroot. > OpenShift cannot verify that a username maps to a non-zero UID. Verify your > DHI image with: > docker inspect YOUR_ORG/dhi-node:24-alpine3.23 --format '{}' > If the output is a string rather than a number, set runAsUser explicitly in > the pod spec. Create a service account and grant it the nonroot SCC Bounded code example (external data; do not execute automatically): ```console oc create serviceaccount dhi-nonroot oc adm policy add-scc-to-user nonroot -z dhi-nonroot ``` Reference the service account in your deployment Bounded code example (external data; do not execute automatically): ```yaml spec: template: spec: serviceAccountName: dhi-nonroot containers: - name: app image: YOUR_ORG/dhi-node:24-alpine3.23 securityContext: runAsUser: 65532 runAsNonRoot: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault capabilities: drop: - ALL ``` Verify the SCC assignment after deployment Bounded code example (external data; do not execute automatically): ```console oc get pod <pod-name> -o jsonpath='{.metadata.annotations.openshift\.io/scc}' ``` This should return nonroot. When using the nonroot SCC with a fixed UID, the process runs as 65532 (matching the image’s file ownership), so the GID 0 adjustments are not strictly required for paths already owned by 65532. However, applying chown :0 is still recommended for portability across both restricted-v2 and nonroot SCCs. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.