Do I Must Run Cron Service with Root Privilege in Containers?

[baojingh]

Hello all, about starting cron service in docker container with non-root user.

Issue:
Failed to create crond.pid, cannot start cron, because of permission denied.

Expectation:
I hope my services inside containers are secure and have no root privileges.
I hope to start cron service with non-root user. And I hope each cron job could be executed with non-root user.

My Solution:

Dockerfile

FROM Debian:12

RUN set -eu \
    && apt-get update \
    && apt-get -y --no-install-recommends install \
                        cron \
    && groupadd -r secur1ty --gid=1000 \
    && useradd -r -g secur1ty --uid=1000 --home-dir=/home/secur1ty --shell=/bin/bash secur1ty \
    && chown root:root /etc/cron.d/myCron \
    && chmod 644    /etc/cron.d/myCron
    && chmod u+s /usr/sbin/cron \
    && crontab -u root /etc/cron.d/myCron \

USER secur1ty

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

docker-entrypoint.sh

#!/bin/bash
set -e
NORMAL_SECUR1TY="secur1ty"
main() {
    # start cron service
    cron
    # execute biz service
    xxx
}
main "$@"

myCron

*/10 * * * * secur1ty echo "hello" 

The crond.pid file status in /var/run/ path

-rw-r--r-- 1 root secur1ty    3 Nov  7 06:30 crond.pid                                                                                                                                     
---------- 1 root secur1ty    0 Nov  7 06:30 crond.reboot 

cron status inside docker container

ENV:
Debian 12

Questions:

1. Cron service in container must be started by root? It is not secure, is it?
2. myCron file owner should be root?
3. Why the crond.pid group owner is secur1ty nor root?

Thank you all.