Problem
A pod can run under a non-root Kubernetes security context while a scanner still reports the image as root because its OCI Config.User is empty or names a user instead of declaring a numeric UID. This affects distributed dependency, helper, and runtime images in the self-managed stack.
Images
The legacy nv-api-keys artifact name is replaced by nvcf-api-keys-service in the current version catalog.
Work
- Audit supported released digests for both architectures, including image metadata and writable paths.
- Publish non-root variants, or select maintained upstream variants that declare a numeric non-root user.
- Advance the owning stack inventory, chart pins, mirror guidance, and version catalog when references change.
- Verify fresh install and upgrade behavior in both Helmfile topologies.
Acceptance criteria
Every distributed image in this group declares a numeric non-root OCI user and runs under a compatible chart security context. Verify the released digest, not only a local build.
Parent: #2071
Problem
A pod can run under a non-root Kubernetes security context while a scanner still reports the image as root because its OCI
Config.Useris empty or names a user instead of declaring a numeric UID. This affects distributed dependency, helper, and runtime images in the self-managed stack.Images
nats-server)nats-server-config-reloader)alpine-k8s)The legacy
nv-api-keysartifact name is replaced bynvcf-api-keys-servicein the current version catalog.Work
Acceptance criteria
Every distributed image in this group declares a numeric non-root OCI user and runs under a compatible chart security context. Verify the released digest, not only a local build.
Parent: #2071