Run Sample Apps as Non Root

[danielhelfand]

When testing out the guestbook sample app on a cluster in a restricted environment, the deployment fails due to the guestbook container being run as root. It would be nice to specify a securityContext for the deployment since it should not need privileged permissions.

While this is a sample app, it would be nice to promote the practice of not running containers as root and also help to prevent running into the issue of the Getting Started tutorial not working in certain Kubernetes environments.

[komish]

Bump! It would nice to see restricted-friendly examples.

Would prefer to see the guestbook example use a high-numbered port at the very least as it seems like the quickest path.

[hect1995]

Do you know how can we easily avoid this issue? As I am running the examples on Openshift 4 and I am getting all the time the error:

(13)Permission denied: AH00072: make_sock: could not bind to address [::]:80

[komish]

@hect1995 The simplest way I've found is just to bind to a high-numbered port in the sample application, and pass that through to the manifests.

[vajravelu1]

for those looking for quick fix for the solution
oc adm policy add-scc-to-user anyuid -z default

which will give the service account default permission to run service on privileged ports like 80