Which steps help ensure a container runs as a non-root user in OpenShift?

• A. Set an environment variable to disable root usage.
• B. Run the container as root but rely on filesystem permissions.
• C. Build or install the image to run as a specific non-root UID and configure the SCC to allow non-root, with runAsNonRoot set.
• D. Disable all security context constraints.

Answer: (C)

OpenShift enforces non-root execution through SecurityContextConstraints, so you ensure a container runs as a non-root by building the image to include a specific non-root UID and configuring the pod to run as that user. In practice, you set the container to run as a non-root UID (runAsUser) and enable runAsNonRoot in the security context, while making sure the image has that user and the filesystem permissions are appropriate for that user. The SCC must permit non-root runs, and with runAsNonRoot set, OpenShift will prevent the container from starting if it would run as root. This combination guarantees the process cannot elevate to root, aligning the runtime with OpenShift security policies. Relying on an environment variable to disable root usage isn’t reliable, and disabling security constraints would defeat the purpose of the policy.