[BUG] Support non-root container execution and custom CA certificate configuration for hardened Docker images

Status Open
Reported on v2.1.170
Maintainer reply ✓ Yes — bcherny
Activity 4 comments · opened Jun 10, 2026
💡 Likely answer: A maintainer (bcherny, collaborator) responded on this thread — see the highlighted reply below.

Bug Description
I literally asked an agentic programming agent to use dhi.io docker hardened images to deploy secure deployments and investigate the differences in the configurations. usually dhi.io hardened helm charts and images do not run as root and it requires a diffrent way to configure them, esp when passing in things like privateCA's, etc. Please get this updated. not usable if this is a blocker.

Environment Info

  • Platform: darwin
  • Terminal: Apple_Terminal
  • Version: 2.1.170
  • Feedback ID: c0bf23d1-ef68-4072-9ba2-eb6b008919ae

Errors

[]

View original on GitHub ↗

4 Comments

derhornspieler · 3 months ago

Any update?

derhornspieler · 3 months ago

This appears to be a bug rather than a feature request. Could the team review and apply the 'bug' label if appropriate?

bcherny collaborator · 1 month ago

Two things that may already cover this:

If you're hitting a specific error with a hardened base image (which image, which command fails, and the error), please share it and we can dig in.

🤖 Generated with Claude Code

derhornspieler · 1 month ago
Two things that may already cover this: - Claude Code runs fine as a non-root user; the reference dev container runs it that way, and unattended mode actually requires a non-root user. https://code.claude.com/docs/en/devcontainer - Private/corporate CAs are picked up via NODE_EXTRA_CA_CERTS=/path/to/ca.pem. https://code.claude.com/docs/en/network-config If you're hitting a specific error with a hardened base image (which image, which command fails, and the error), please share it and we can dig in. 🤖 Generated with Claude Code

I'm referring to anytime I am building with Claude code using dhi.io images (Keycloak is a great example) Fable flags cyber security related and prevents me from using the model.