CKAD Practice Question: Application Environment, Configuration and Security
A pod's container has securityContext with runAsNonRoot: true but no runAsUser set. The container image has a user 'appuser' with UID 1001. Will the pod run successfully?
⚠ Common exam trap
CNCF often tests the misconception that `runAsNonRoot` requires an explicit `runAsUser` field, but the correct behavior is that Kubernetes falls back to the container image's user if no `runAsUser` is set.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the container image user is non-root
When `runAsNonRoot: true` is set in the pod's security context without an explicit `runAsUser`, Kubernetes checks the container image's user (as defined in the Dockerfile `USER` directive). If that user is non-root (UID 1001 in this case), the container runs as that user, satisfying the non-root requirement. The pod will start successfully because the image user is non-root, and no explicit `runAsUser` is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No, because runAsNonRoot requires an explicit runAsUser
Why it's wrong here
The claim is false because runAsNonRoot does not mandate an explicit runAsUser. When runAsUser is omitted, Kubernetes evaluates the image's USER metadata to determine the effective UID; runAsNonRoot then verifies that UID is not 0. It is a standalone admission check, so a container image that defaults to a non-root user satisfies it without any explicit UID override.
- ✗
No, because the container image user is unknown
Why it's wrong here
The premise that the container image user is unknown is incorrect. Every container image has a USER field in its configuration, and if that field is absent, the effective user defaults to root (UID 0); the kubelet receives this metadata from the container runtime. Therefore, the user is always detectable, and runAsNonRoot can be evaluated before the container starts.
- ✗
Yes, because runAsNonRoot is ignored if runAsUser is not set
Why it's wrong here
runAsNonRoot is never ignored merely because runAsUser is absent. If no explicit runAsUser is provided, the Pod uses the image's configured user, and runAsNonRoot: true forces a validation that this user is non-root; in fact, it can cause a container to be rejected if the image user is root. The flag remains active and enforces the non-root requirement regardless of whether runAsUser is set.
- ✓
Yes, because the container image user is non-root
Why this is correct
This is correct because the container image sets a non-root default user (UID 1001) in its metadata. With runAsNonRoot: true and no explicit runAsUser in the securityContext, the kubelet verifies that the image's effective UID is not 0; since 1001 is non-root, the container is permitted to run. The flag acts as a guard that confirms the actual user the container will run as is safe.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.