Run Pebble with runAsNonRoot

Signed-off-by: Richard Wall <richard.wall@jetstack.io>

devel/addon/pebble/BUILD.bazel

@@ -1,6 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 
 # gazelle:ignore
 
@@ -12,9 +13,16 @@ container_bundle(
     tags = ["manual"],
 )
 
+container_image(
+    name = "nonroot_go_image_static",
+    base = "@go_image_static//image",
+    # See https://github.com/GoogleContainerTools/distroless/blob/2cac07c7c62b2dc52c4274a1810939fb06039ab9/base/base.bzl#L9
+    user = "65532",
+)
+
 go_image(
     name = "image",
-    base = "@static_base//image",
+    base = ":nonroot_go_image_static",
     binary = ":app",
     tags = ["manual"],
     visibility = ["//visibility:public"],

devel/addon/pebble/chart/templates/deployment.yaml

@@ -23,6 +23,8 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            runAsNonRoot: true
           args:
           - -config=/config/config.json
           - -strict={{ .Values.strict }}