{"record":{"id":"ec21b5821d79f88f","repo":"k3s-io/k3s","slug":"not-running-as-root","errorCode":null,"errorMessage":"not running as root","messagePattern":"not running as root","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/util/permissions/permissions_others.go","lineNumber":14,"sourceCode":"//go:build !windows\n\npackage permissions\n\nimport (\n\t\"errors\"\n\t\"os\"\n)\n\n// IsPrivileged returns an error if the process is not running as root.\n// Ref: https://github.com/kubernetes/kubernetes/pull/96616\nfunc IsPrivileged() error {\n\tif os.Getuid() != 0 {\n\t\treturn errors.New(\"not running as root\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":1,"sourceCodeEnd":18,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/util/permissions/permissions_others.go#L1-L18","documentation":"IsPrivileged in the non-Windows build (permissions_others.go) returns this error when the process effective user id is not 0. It is the Unix counterpart of the Windows BUILTIN\\Administrators check (ref kubernetes#96616) and gates operations that require root: cgroups, /proc writes, containerd, iptables.","triggerScenarios":"Any code path calling permissions.IsPrivileged() while os.Getuid() != 0: starting the agent/server as an unprivileged user, or from a supervisor/wrapper that drops uid before exec.","commonSituations":"Running the binary from a plain user shell instead of sudo; systemd unit with User=someuser; containers that drop capabilities; CI pipelines running non-root.","solutions":["Run the binary as root: sudo k3s agent ... or a systemd service without a non-root User= directive","If rootless operation is intended, use the project's supported rootless setup and avoid the code paths that call IsPrivileged","Check that an earlier wrapper (su, setpriv, container entrypoint) did not drop privileges before the check"],"exampleFix":"# before\n$ k3s agent --server https://server:6443 --token ...\n\n# after\n$ sudo k3s agent --server https://server:6443 --token ...","handlingStrategy":"validation","validationCode":"if os.Getuid() != 0 {\n    log.Fatal(\"this program must run as root (sudo)\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deploy via systemd as root instead of ad-hoc user shells","Add a startup euid check with a clear message before any privileged work begins","If rootless is a hard requirement, follow the project's rootless docs rather than dropping uid mid-flight"],"tags":["permissions","root","linux","unix"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}