[QUESTION] Is it possible to run sandbox without root privileges?

[lisngt]

Hi all,

I would like to ask if it's possible to run sandbox without root priviledges?
Our policy doesn't allow to run pod with as root. If I turn on runAsNonRoot = true, sandbox won't run anymore.

I have this error

My values.yml

sandbox:
  podSecurityContext:
    fsGroup: 2000
  securityContext: 
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    # readOnlyRootFilesystem: true
    seccompProfile:
      type: RuntimeDefault
    runAsNonRoot: true
    runAsUser: 1000

Thank you.

Regards.

[LeoQuote]

Your log shows that the program is unable to write logs, please consider mount an emptydir for this folder to see if it helps

[lisngt]

Dear @LeoQuote ,

I have added an emptydir as following but it doesn't help at all.

sandbox:
  podSecurityContext:
    fsGroup: 2000
  securityContext: 
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    # readOnlyRootFilesystem: true
    seccompProfile:
      type: RuntimeDefault
    runAsNonRoot: true
    runAsUser: 1000
  volumeMounts:
    - name: logs-storage
      mountPath: /logs
  volumes:
    - name: logs-storage
      emptyDir: {}

Thank you.

Regards

PS: I let Opus 4.6 check the error for me, he means that the helmchart doesn't support custom volumes.

[LeoQuote]

It is recommended to directly modify the deployment and add an emptyDir to try to resolve the issue. If it works, you are welcome to submit a related PR; if not, please contact the Dify project team for further assistance.