# Enabling Images to Run with the USER Specified in the Dockerfile

By default, programs in OpenShift containers run with a user the `uid` of which is automatically pre-allocated by the cluster. As we need the EMS server to run with the specific `uid` required by NFS, we must create a new Security Context Constraint (SCC) to address this. We will export the existing `restricted` SCC and use it as a basis for our new SCC.

## Procedure

1. As `system:admin`, export the restricted SCC into a file:

       > oc get -o yaml scc/restricted > nfs-scc.yaml

2. Edit this file and give this SCC a new name by changing `restricted` into `nfs-scc` and give it a higher priority.
3. Add a `uidRangeMax` and a `uidRangeMin` field to the `runAsUser` entry. These define a range of allowed `uid` values and should match the values you expect your pods to use for accessing NFS. For example:

       …
       metadata:
       …
         name: nfs-scc (1)
       priority: 9 (2)
       …
       runAsUser:
         type: MustRunAsRange
         uidRangeMax: 13000 (3)
         uidRangeMin: 12000 (3)
       …

   `(1)`: Name of this new SCC.

   `(2)`: Larger values mean greater priority.

   `(3)`: The range of allowed `uid` values will be `12000-13000`. This works with the `12500 uid` set in Creating the Base Docker Image.

4. Create the new SCC using the following command

       > oc create -f nfs-scc.yaml

5. Check the result

       > oc get -o yaml scc/nfs-scc

   Note: Edit the new SCC using the command:

       > oc edit scc/nfs-scc

   Note: You create the SSC once for the lifetime of the cluster.

Copyright © Cloud Software Group, Inc. All rights reserved.