Error: container has runAsNonRoot and image will run as root

[jonnolen]

Report

Pods using the helm install method in the documentation fail to start with error "Error: container has runAsNonRoot and image will run as root".

published image for 2.17.2 does not report having a non-root User:
docker inspect ghcr.io/kedacore/keda-admission-webhooks:2.17.2

[
    {
        "Id": "sha256:c8227c6edb4d9926f7ed366bc8f383e9e461c6dd58d708e97539ad9393caffa8",
        "RepoTags": [
            "ghcr.io/kedacore/keda-admission-webhooks:2.17.2"
        ],
        "RepoDigests": [
            "ghcr.io/kedacore/keda-admission-webhooks@sha256:c8227c6edb4d9926f7ed366bc8f383e9e461c6dd58d708e97539ad9393caffa8"
        ],
        "Parent": "",
        "Comment": "",
        "DockerVersion": "",
        "Author": "",
        "Architecture": "",
        "Os": "",
        "Size": 26029565,
        "GraphDriver": {
            "Data": null,
            "Name": "overlayfs"
        },
        "RootFS": {},
        "Metadata": {
            "LastTagTime": "2025-10-01T19:33:40.213923504Z"
        },
        "Descriptor": {
            "mediaType": "application/vnd.oci.image.index.v1+json",
            "digest": "sha256:c8227c6edb4d9926f7ed366bc8f383e9e461c6dd58d708e97539ad9393caffa8",
            "size": 1609
        },
        "Config": {
            "Cmd": null,
            "Entrypoint": null,
            "Env": null,
            "Labels": null,
            "OnBuild": null,
            "User": "",
            "Volumes": null,
            "WorkingDir": ""
        }
    }
]

Expected Behavior

Following deploy steps in documentation results in a usable KEDA installation with no errors.

Actual Behavior

0 of 3 pods are available due to above error.

Steps to Reproduce the Problem

1. helm install keda kedacore/keda --namespace keda --create-namespace
2. kubectl get pods -n keda

Pods show 0/1 for all three deployments with CreateContainerConfigError

Logs kubeclt -n keda describe pod/....

  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  47s               default-scheduler  Successfully assigned keda/keda-admission-webhooks-674cbfffd9-qz6wg to docker-desktop
  Normal   Pulled     46s               kubelet            Successfully pulled image "ghcr.io/kedacore/keda-admission-webhooks:2.17.2" in 271ms (864ms including waiting). Image size: 26029565 bytes.
  Normal   Pulled     45s               kubelet            Successfully pulled image "ghcr.io/kedacore/keda-admission-webhooks:2.17.2" in 290ms (290ms including waiting). Image size: 26029565 bytes.
  Normal   Pulled     32s               kubelet            Successfully pulled image "ghcr.io/kedacore/keda-admission-webhooks:2.17.2" in 332ms (332ms including waiting). Image size: 26029565 bytes.
  Normal   Pulled     18s               kubelet            Successfully pulled image "ghcr.io/kedacore/keda-admission-webhooks:2.17.2" in 308ms (702ms including waiting). Image size: 26029565 bytes.
  Normal   Pulling    7s (x5 over 46s)  kubelet            Pulling image "ghcr.io/kedacore/keda-admission-webhooks:2.17.2"
  Warning  Failed     6s (x5 over 46s)  kubelet            Error: container has runAsNonRoot and image will run as root (pod: "keda-admission-webhooks-674cbfffd9-qz6wg_keda(81e5a88c-b222-4b05-8c5b-2a7999a20d9a)", container: keda-admission-webhooks)
  Normal   Pulled     6s                kubelet            Successfully pulled image "ghcr.io/kedacore/keda-admission-webhooks:2.17.2" in 401ms (401ms including waiting). Image size: 26029565 bytes.

KEDA Version

2.17.2

Kubernetes Version

Other

Platform

Other

Scaler Details

No response

Anything else?

This issue is occurring in Docker for Desktop, Mac OS 26.0.1,

docker version
Client:
 Version:           28.4.0
 API version:       1.51
 Go version:        go1.24.7
 Git commit:        d8eb465
 Built:             Wed Sep  3 20:56:26 2025
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.47.0 (206054)
 Engine:
  Version:          28.4.0
  API version:      1.51 (minimum version 1.24)
  Go version:       go1.24.7
  Git commit:       249d679
  Built:            Wed Sep  3 20:58:53 2025
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

kubectl version
Client Version: v1.34.1
Kustomize Version: v5.7.1
Server Version: v1.34.1

[jonnolen]

I can work around the install issue with this monster of a command (derived by digging in the charts repo):

helm install keda kedacore/keda --namespace keda --create-namespace \
--set securityContext.webhooks.runAsUser=65532 \
--set securityContext.webhooks.runAsGroup=65532 \
--set securityContext.webhooks.runAsNonRoot=true \
--set securityContext.metricServer.runAsUser=65532 \
--set securityContext.metricServer.runAsGroup=65532 \
--set securityContext.metricServer.runAsNonRoot=true \
--set securityContext.operator.runAsUser=65532 \
--set securityContext.operator.runAsGroup=65532 \
--set securityContext.operator.runAsNonRoot=true

[jonnolen]

if i build the operator image locally with the docker version listed above, the docker inspect command correctly returns that the User is 655332:65532.

[inrdkec]

Hello @jonnolen,

the 3 Docker images define non-root users:

• keda/Dockerfile

  Line 39 in 6d6fad0

  # 65532 is numeric for nonroot

• keda/Dockerfile.adapter

  Line 39 in 03c6fa5

  # 65532 is numeric for nonroot

• keda/Dockerfile.webhooks

  Line 39 in 03c6fa5

  # 65532 is numeric for nonroot

If I inspect the images I can see the user:
docker inspect ghcr.io/kedacore/keda-admission-webhooks:2.17.2 | jq '.[].Config.User' "65532:65532"

Also if I deploy locally using local k8s cluster (using kind) I have no issues:

$ kind create cluster
$ kubectx kind-kind
$ helm repo add kedacore https://kedacore.github.io/charts
$ helm repo update
$ helm install keda kedacore/keda --namespace keda --create-namespace
$ kubens keda
$ kubectl get pods
NAME                                               READY   STATUS    RESTARTS       AGE
keda-admission-webhooks-xxxx          1/1     Running   0              148m
keda-operator-xxx                     1/1     Running   0   148m
keda-operator-metrics-apiserver-xxx   1/1     Running   0              148m
$ kubectl describe pod keda-operator-xxxx
Name:             keda-operator-xxx
Namespace:        keda
Priority:         0
Service Account:  keda-operator
Node:             kind-control-plane/x.x.x.x
Labels:           app=keda-operator
                  app.kubernetes.io/component=operator
                  app.kubernetes.io/instance=keda
                  app.kubernetes.io/managed-by=Helm
                  app.kubernetes.io/name=keda-operator
                  app.kubernetes.io/part-of=keda-operator
                  app.kubernetes.io/version=2.17.2
                  helm.sh/chart=keda-2.17.2
                  name=keda-operator
                  pod-template-hash=xxx
...
Events:
  Type    Reason     Age                 From               Message
  ----    ------     ----                ----               -------
  Normal  Scheduled  108s                default-scheduler  Successfully assigned keda/keda-operator-xxx to kind-control-plane
  Normal  Pulled     91s                 kubelet            Successfully pulled image "ghcr.io/kedacore/keda:2.17.2" in 16.212s (16.212s including waiting). Image size: 75858283 bytes.
  Normal  Pulling    90s (x2 over 107s)  kubelet            Pulling image "ghcr.io/kedacore/keda:2.17.2"
  Normal  Created    89s (x2 over 91s)   kubelet            Created container: keda-operator
  Normal  Started    89s (x2 over 91s)   kubelet            Started container keda-operator
  Normal  Pulled     89s                 kubelet            Successfully pulled image "ghcr.io/kedacore/keda:2.17.2" in 648ms (648ms including waiting). Image size: 75858283 bytes.