Skip to content

Can't run OPA container without --uid 0 #585

@dcantah

Description

@dcantah

Discussed in #564

Originally posted by anderseknert August 31, 2025
I'm not sure whether this is an issue or expected behavior, so I'm raising it here first. Trying to run an OPA container fails unless --uid 0 is passed. The Dockerfile of that project sets the default uid/gid to 1000:1000. Running this with Docker or Podman works without issues, while container run doesn't handle this:

> run openpolicyagent/opa:1.8.0-static version
Error: internalError: "failed to start container" (cause: "internalError: "failed to start process (cause: "internal error (13): create managed process: internalError: "Cannot find User '1000' in passwd file."")"")

Only running with --uid 0 has the container run successfully.

I have tried and failed to find any documentation on whether this is expected or not. In case this is by design, it would be great if there were some docs explaining this, and whether there is a way to run containers with uid > 0.

(and apologies if there are docs on this that I just couldn't find)

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions