From 8e387ca55357311814b30161b5a391ad21a78cd2 Mon Sep 17 00:00:00 2001 From: wangbo Date: Wed, 29 Jul 2026 02:28:19 +0800 Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E5=9B=BA=E5=AE=9A=20API=20?= =?UTF-8?q?=E5=AE=B9=E5=99=A8=E8=BF=90=E8=A1=8C=E8=BA=AB=E4=BB=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit API 镜像使用名称用户 appuser，Kubelet 无法仅凭 runAsNonRoot 验证其非 root 身份，导致 CreateContainerConfigError。按照 Dockerfile 中固定 UID 10001 显式设置 runAsUser、runAsGroup 和 fsGroup，确保 EmptyDir 可写且满足 Pod 安全约束。\n\n验证：kubectl kustomize 渲染成功，两个 API Deployment 均包含 UID/GID 10001，git diff --check 通过。 --- deploy/kubernetes/production/application.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/deploy/kubernetes/production/application.yaml b/deploy/kubernetes/production/application.yaml index f7481f7..db76632 100644 --- a/deploy/kubernetes/production/application.yaml +++ b/deploy/kubernetes/production/application.yaml @@ -32,6 +32,10 @@ spec: easyai.io/workload: "true" securityContext: runAsNonRoot: true + runAsUser: 10001 + runAsGroup: 10001 + fsGroup: 10001 + fsGroupChangePolicy: OnRootMismatch seccompProfile: type: RuntimeDefault containers: @@ -134,6 +138,10 @@ spec: easyai.io/workload: "true" securityContext: runAsNonRoot: true + runAsUser: 10001 + runAsGroup: 10001 + fsGroup: 10001 + fsGroupChangePolicy: OnRootMismatch seccompProfile: type: RuntimeDefault containers: