RKE2 rootless images

[sergorud]

Hello friends! 
I have a task to deploy rke2 with images that do not have root. Can you tell me if it is possible to get rid of root in all rke2 system images? If not, why can't something be run without a root user? And are there any plans to come to such a decision?

[manuelbuil]

Can you be more specific about what you mean by "root"? As you know, root can have different meanings in the world of Linux. And could you also explain the benefits of running without "root"?

[sergorud]

Yes, he expressed himself ambiguously. I need to get rid of the root user in the container and rebuild it to work from another user. So that the processes in the container start from a regular user.

[manuelbuil]

You want to do that in RKE2 system containers? Why? Is it a security concern? Would this perhaps help ==> https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/

[sergorud]

Yes, this is a security issue. there is such a requirement from the security service. We need to do something in the style of a docker hardened image so that there are no vulnerabilities and no root id. But here the question is rather about this possibility - does having a root user have any justification? I'm arguing why it's impractical to do this. Thanks for the link