CKAD Practice Question: Application Environment, Configuration and Security
A pod fails to start with a 'CreateContainerConfigError'. Running 'kubectl describe pod my-pod' reveals: 'Error: container has runAsNonRoot and image will run as root'. The pod definition includes 'securityContext.runAsNonRoot: true'. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume the error is about missing runAsUser or capabilities, but the error message directly points to the image's default user being root, which is a mismatch with the runAsNonRoot constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The container image's default user is root (UID 0), conflicting with runAsNonRoot
The error 'container has runAsNonRoot and image will run as root' occurs because the pod's securityContext sets `runAsNonRoot: true`, but the container image's default user is root (UID 0). Kubernetes checks the image's user at container startup; if the image runs as root and the pod enforces non-root, the container fails to start with a CreateContainerConfigError.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container does not have the CAP_SYS_ADMIN capability
Why it's wrong here
CAP_SYS_ADMIN is a Linux capability that grants administrative operations such as mounting filesystems or performing system administration tasks. It is unrelated to the runAsNonRoot security context setting, which only validates the numeric user ID under which the container will run. The CreateContainerConfigError in this scenario indicates a user ID mismatch, not a missing capability, so this option is incorrect.
- ✓
The container image's default user is root (UID 0), conflicting with runAsNonRoot
Why this is correct
When runAsNonRoot: true is set, the kubelet inspects the container image's configured user (typically the USER instruction or default UID). If the image's default user is root (UID 0), the kubelet refuses to start the container and emits an error such as 'container has runAsNonRoot and image will run as root'. Since the error is CreateContainerConfigError, it exactly matches this contradiction between the securityContext and the image's default user, making this the correct cause.
- ✗
The container's filesystem is read-only
Why it's wrong here
Setting readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, which prevents writes to the filesystem but has no effect on user ID validation. The runAsNonRoot check is performed by the kubelet before the container starts, based on the image's user metadata, not on mount options. Therefore a read-only filesystem would not produce this error and this option is wrong.
- ✗
The runAsUser field is missing, so the pod uses a random UID
Why it's wrong here
If runAsUser is omitted, the container runs as the user defined in the image's configuration, not a randomly assigned UID. When runAsNonRoot: true is set, Kubernetes only requires that the resulting effective UID be non-zero; if the image's default user is already non-root, the pod will start successfully. The error message specifically states the image will run as root, so the issue is the image's default user, not a missing runAsUser field.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.