Kubernetes runAsNonRoot incompatibility with run-user: _daemon_

[berkayoz]

Bug Description

Some deployments are setting runAsNonRoot: true for the pod security context which prevents a container from running as root. To possibly address this we've set run-user: _daemon_ however Kubernetes checks uid/gid numerically and complains about the _daemon_ user.

You can find the Kubernetes implementation here

As a work around we have to set securityContext.runAsUser=584792 manually on manifests which hurts the drop-in image replacement story. Could we possibly set numeric UID as the OCI user by default?

Your help is much appreciated, many thanks!

To Reproduce

Deploy a Pod that uses a rock with the securityContext set as so

spec:
  securityContext:
    runAsNonRoot: true

You can also check out our cert-manager tests to verify it in a real world example.

Environment

Ubuntu 24.04

rockcraft.yaml

name: cert-manager-controller
summary: ROCK for the cert-manager-controller Project.
description: |
  This ROCK is a drop-in replacement for the autoscaling/cert-manager-controller image.
version: "1.12.2"
license: Apache-2.0

base: bare
build-base: [email protected]
platforms:
  amd64:
  arm64:

run-user: _daemon_
entrypoint-service: cert-manager-controller
services:
  cert-manager-controller:
    override: replace
    summary: "cert-manager-controller service"
    startup: enabled
    command: "/controller-linux [ -h ]"
    on-failure: shutdown

parts:
  cert-manager-controller:
    plugin: nil
    source: https://github.com/cert-manager/cert-manager.git
    source-type: git
    source-tag: v1.12.2
    source-depth: 1
    build-snaps:
      - jq
      - go/1.22/stable
    override-build: |
      # CTR=echo is hacky way of passing docker check not required for build
      make CTR=echo _bin/server/controller-linux-${CRAFT_PLATFORM}
      cp _bin/server/controller-linux-${CRAFT_PLATFORM} ${CRAFT_PART_INSTALL}/controller-linux
    prime:
      - controller-linux

Relevant log output

Error: container has runAsNonRoot and image has non-numeric user (_daemon_), cannot verify user is non-root