Quarkus native with jib in Kubernetes/Docker without running as root

[erik-wramner]

I'm trying to avoid running as root in the native container images for Quarkus. I'm building with jib using:

-Dquarkus.jib.user=1001

This only works partially. When I start the container I can enter into it (docker exec -it ...) and check the current user:

bash-4.4$ whoami
whoami: cannot find name for user ID 1001

That is what I want. However, it seems the application is still running as root:

bash-4.4$ ls -l /proc/*/exe
lrwxrwxrwx 1 1001 root 0 Feb  3 09:14 /proc/1/exe -> /work/application
lrwxrwxrwx 1 1001 root 0 Feb  3 09:10 /proc/23/exe -> /usr/bin/bash
lrwxrwxrwx 1 1001 root 0 Feb  3 09:14 /proc/self/exe -> /usr/bin/coreutils
lrwxrwxrwx 1 1001 root 0 Feb  3 09:14 /proc/thread-self/exe -> /usr/bin/coreutils

See first line, /work/application. What should I do to get the application to run using the configured user? I would like to avoid building the docker image manually if possible, it is much more convenient to build with jib. This is not only one image but a whole range of services, I'd really like to keep it simple. I'd also like to keep it secure though.

[quarkus-bot[bot]]

/cc @Sgitario (kubernetes), @geoand (jib,kubernetes), @iocanel (kubernetes)

[erik-wramner]

Or wait - I can't read. Looking at the output again, the user for the process is 1001 and root is actually the group. Then it is working as designed. Sorry - closing.

[geoand]

Thanks for the update :)