What causes "not running as root" in k3s-io/k3s?

Run the binary as root: sudo k3s agent ... or a systemd service without a non-root User= directive

not running as root

Error message

not running as root

What it means

IsPrivileged in the non-Windows build (permissions_others.go) returns this error when the process effective user id is not 0. It is the Unix counterpart of the Windows BUILTIN\Administrators check (ref kubernetes#96616) and gates operations that require root: cgroups, /proc writes, containerd, iptables.

Source

Thrown at pkg/util/permissions/permissions_others.go:14

//go:build !windows

package permissions

import (
	"errors"
	"os"
)

// IsPrivileged returns an error if the process is not running as root.
// Ref: https://github.com/kubernetes/kubernetes/pull/96616
func IsPrivileged() error {
	if os.Getuid() != 0 {
		return errors.New("not running as root")
	}
	return nil
}

View on GitHub (pinned to 6ba341e396)

Solutions

Run the binary as root: sudo k3s agent ... or a systemd service without a non-root User= directive
If rootless operation is intended, use the project's supported rootless setup and avoid the code paths that call IsPrivileged
Check that an earlier wrapper (su, setpriv, container entrypoint) did not drop privileges before the check

Example fix

# before
$ k3s agent --server https://server:6443 --token ...

# after
$ sudo k3s agent --server https://server:6443 --token ...

Defensive patterns

Strategy: validation

Validate before calling

if os.Getuid() != 0 {
    log.Fatal("this program must run as root (sudo)")
}

Prevention

Deploy via systemd as root instead of ad-hoc user shells
Add a startup euid check with a clear message before any privileged work begins
If rootless is a hard requirement, follow the project's rootless docs rather than dropping uid mid-flight

When it happens

Trigger: Any code path calling permissions.IsPrivileged() while os.Getuid() != 0: starting the agent/server as an unprivileged user, or from a supervisor/wrapper that drops uid before exec.

Common situations: Running the binary from a plain user shell instead of sudo; systemd unit with User=someuser; containers that drop capabilities; CI pipelines running non-root.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/ec21b5821d79f88f. Report an issue: GitHub.