The currently accepted answer sort of implies that you can just set any random non-root UID and be good. I want to clarify a bit for future readers.
Firstly, to make sure everyone is on the same page, Kubernetes currently doesn't support user namespacing as per this issue. This is despite it now being a feature in the Linux kernel and also Docker. So in Kubernetes, when you specify a pod or container securityContext
with a runAsUser
UID, that UID will be the one in use on both the host node and also within the container. So leads us to your question (and also mine before researching): what UID should you use?
So firstly, yes, everywhere and everyone agrees that it should not be root (UID 0). But it can't be an entirely random UID. If the UID collides with an existing user, with say passwordless sudo permissions, that's effectively root. That's not the only bad case however, you also for example wouldn't want the UID to collide with, say, your MySQL database user. So you want to assign a UID that either a) has no user already assigned to it, or b) to a user you've specifically created on the host for this purpose.
With Google Kubernetes Engine, if you're running with Container Optimized OS images, there seems to be a convention for UID values:
Choose an ID from the [2000, 4999] range to avoid collision with other user accounts.
[1] https://cloud.google.com/container-optimized-os/docs/how-to/create-configure-instance
Inspecting one of our GKE nodes, this seems to be correct, as I see SSH users being assigned UIDs starting at 5000. So on our GKE cluster, we've just assigned UID/GID 2000 for our containers.