"kubectl debug" throws "container has runAsNonRoot and image has non-numeric user"

[Voriaz]

Hi,

I tried to use the kubectl debug command to attach an ephemeral netshoot container to a pod but I received this error message:

Warning: container debugger-5rswx: container has runAsNonRoot and image has non-numeric user (root), cannot verify user is non-root (pod: "cert-manager-webhook-5b965896dd-zwc75_cert-manager(d7ac073d-693c-4bc9-ba43-82643c554604)", container: debugger-5rswx)

The container I want to debug has securityContext: runAsNonRoot: true set and it seems that the netshoot image doesn't have a "numeric user".
From what I saw online, image must have USER <id>:<id> in it's definition.

Is it possible to add this to the netshoot image to be able to debug nonRoot pods ?

Thanks,

A.

[brightzheng100]

This sounds a limitation of K8s: kubernetes/kubernetes#113006

Maybe it would help if we have an image that requires non-root?

[kivra-ahmwar]

I also stumbled upon this. Would love an image that can debug nonRoot pods.

[BojanZelic]

you can work around it with kubectl debug -it my-pod --image=nicolaka/netshoot --custom=<(echo '{"securityContext":{"runAsNonRoot":false,"runAsUser":0}}') -- /bin/bash