From c67d193400eb05779384196fd170079372ad0e56 Mon Sep 17 00:00:00 2001
From: michelligabriele <gabriele.michelli@icloud.com>
Date: Thu, 23 Apr 2026 03:00:04 +0200
Subject: [PATCH] fix(docker.non_root): use numeric UID 65534 for K8s
 runAsNonRoot (#26268)

---
 docker/Dockerfile.non_root                    |  2 +-
 docker/tests/nonroot.yaml                     |  2 +-
 .../test_litellm/test_dockerfile_non_root.py  | 54 +++++++++++++++++++
 3 files changed, 56 insertions(+), 2 deletions(-)
 create mode 100644 tests/test_litellm/test_dockerfile_non_root.py

diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root
index e916167609..3666a850d9 100644
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@@ -138,7 +138,7 @@ RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \
     [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \
     chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache
 
-USER nobody
+USER 65534
 
 RUN prisma generate --schema=./schema.prisma
 
diff --git a/docker/tests/nonroot.yaml b/docker/tests/nonroot.yaml
index 821b1a105a..36118ca8c5 100644
--- a/docker/tests/nonroot.yaml
+++ b/docker/tests/nonroot.yaml
@@ -2,7 +2,7 @@ schemaVersion: 2.0.0
 
 metadataTest:
   entrypoint: ["docker/prod_entrypoint.sh"]
-  user: "nobody"
+  user: "65534"
   workdir: "/app"
 
 fileExistenceTests:
diff --git a/tests/test_litellm/test_dockerfile_non_root.py b/tests/test_litellm/test_dockerfile_non_root.py
new file mode 100644
index 0000000000..694da6368e
--- /dev/null
+++ b/tests/test_litellm/test_dockerfile_non_root.py
@@ -0,0 +1,54 @@
+"""
+Static checks on docker/Dockerfile.non_root.
+
+The non_root image is intended for deployment into hardened Kubernetes
+clusters where `securityContext.runAsNonRoot: true` is enforced. The
+kubelet validates non-root status by parsing the image's USER field as
+an integer — a string name like "nobody" is rejected with
+CreateContainerConfigError because the kubelet cannot resolve
+/etc/passwd inside the image at admission time.
+"""
+
+import os
+import re
+
+import pytest
+
+DOCKERFILE_PATH = os.path.join(
+    os.path.dirname(__file__),
+    "..",
+    "..",
+    "docker",
+    "Dockerfile.non_root",
+)
+
+
+def _final_user_directive(dockerfile_text: str) -> str:
+    """Return the value of the last `USER` directive in the file."""
+    matches = re.findall(r"^USER\s+(\S+)\s*$", dockerfile_text, re.MULTILINE)
+    assert matches, "Dockerfile.non_root has no USER directive"
+    return matches[-1]
+
+
+@pytest.mark.skipif(
+    not os.path.exists(DOCKERFILE_PATH),
+    reason="Dockerfile.non_root not present in this checkout",
+)
+def test_final_user_directive_is_numeric():
+    """The runtime USER must be a numeric UID so kubelet's runAsNonRoot
+    admission check (strconv.Atoi) succeeds."""
+    with open(DOCKERFILE_PATH, "r", encoding="utf-8") as f:
+        contents = f.read()
+
+    final_user = _final_user_directive(contents)
+
+    assert final_user.isdigit(), (
+        f"Dockerfile.non_root final USER is {final_user!r}; must be a numeric UID "
+        "so Kubernetes' runAsNonRoot admission check can verify non-root status. "
+        "See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"
+    )
+
+    assert int(final_user) != 0, (
+        f"Dockerfile.non_root final USER is {final_user} (root); the non_root image "
+        "must run as a non-zero UID."
+    )