Repository navigation
Run CoreDNS as the image's non-root user by default - #277
Merged
Merged
Conversation
The chart's defaults did not satisfy the restricted Pod Security Standard: the container declared no runAsNonRoot and no seccomp profile, so `helm install` into a namespace that enforces the profile was rejected at admission: violates PodSecurity "restricted:latest": runAsNonRoot != true (pod or container "coredns" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "coredns" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") The CoreDNS image has run as the distroless nonroot user, uid and gid 65532, since 1.11.0, with cap_net_bind_service on the binary so it binds port 53. The container securityContext now declares that user (runAsNonRoot, runAsUser and runAsGroup 65532) and the RuntimeDefault seccomp profile. The ids are numeric on purpose: images before 1.14.7 declare the user by name, which the kubelet cannot verify when runAsNonRoot is set (coredns/coredns#7542; the image pins the numeric ids since coredns/coredns#8316, released in 1.14.7). Verified on kind 1.32 in a namespace enforcing restricted: the previous defaults are rejected with the message above; with this change the Deployment rolls out, the container runs as uid 65532 and answers DNS on port 53 through the Service. Minor chart version bump: a user who overrides the image with one that runs as a different user now has to set runAsUser accordingly. Signed-off-by: Martin Matyas <martin.matyas@tieto.com> Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Open
hagaibarel
approved these changes
Sep 29, 2026
Collaborator
|
Thanks for the PR! |
1 task
hagaibarel
pushed a commit
that referenced
this pull request
Sep 29, 2026
CoreDNS 1.14.7 is built with Go 1.26.6 (fixes CVE-2026-56865, CVE-2026-56864, CVE-2026-33818) and patches CVE-2026-86003 and CVE-2026-82399. It also pins a numeric uid/gid for the image's nonroot user (coredns/coredns#8316), which the chart's new runAsNonRoot defaults from #277 reference. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Arti Zirk <arti.zirk@gmail.com>
Merged
1 task
1 task
1 task
Merged
1 task
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why is this pull request needed and what does it do?
The chart's defaults do not satisfy the restricted Pod Security Standard, so
helm installinto a namespace enforcing it is rejected at admission: the container declares neitherrunAsNonRootnor a seccomp profile. Everything else the profile asks for is already there.The CoreDNS image has run as the distroless
nonrootuser (uid and gid 65532) since 1.11.0, withcap_net_bind_serviceon the binary so it binds port 53. This change declares that user on the container (runAsNonRoot,runAsUserandrunAsGroup65532) and setsseccompProfile.type: RuntimeDefault. The ids are numeric on purpose: images before 1.14.7 declare the user by name, which the kubelet cannot verify whenrunAsNonRootis set (coredns/coredns#7542, fixed in the image by coredns/coredns#8316 and released in 1.14.7). With the numeric ids the defaults work on every image since 1.11.0.Verified on kind 1.32 in a namespace enforcing
restricted: the previous defaults are rejected with the message above; with this change the Deployment rolls out, the container runs as uid 65532 and answers DNS on port 53 through the Service.A unit test asserts the rendered defaults. Minor version bump, since a user who overrides the image with one running as a different user now has to set
runAsUserto match.Which issues (if any) are related?
#39 proposed
runAsNonRootin 2021, when the image still ran as root; this picks that up now that the image supports it. coredns/coredns#7542 and coredns/coredns#8316 for the image side.Checklist:
🤖 Generated with Claude Code