I wanted DefectDojo to run in a hardened Kubernetes cluster where every container is non‑root. I pulled the official Helm chart. Call helm install additionally preconfigured, and… CrashLoopBackOff in seconds.
Turns out the nginx sidecar refuses to live without UID 0. It tries to rewrite its own nginx.conf, create cache folders, and generally acts like it owns the place. With root stripped away, it dies instantly, and because the chart treats nginx as mandatory, the whole pod goes down. The Django container could have worked, but without nginx, none of the static files were there, so the UI was a mess.
There are not so many logs in the failed containers, just: sed: can't create temp file '/etc/nginx/nginx.confXXXXXX': Permission denied
After a couple of hours of frustration, I threw nginx away. I activated the next environment variable: DD_WHITENOISE=true, which makes Django serve its own CSS and JS, and added a tiny init container that copies all the static assets from the official nginx image into a shared volume. The Django app mounts that volume at the /app/static, starts up as UID 1001 with a read‑only filesystem, and everything finally loads.
Did it help? Yes. Is it perfect? No. Whitenoise is fine for a few hundred static requests per second, but it also breaks the defectdojo architecture. If you pointed to a more adequate solution, it would be better to fix it differently.
Still, if you need DefectDojo rootless today, this duct‑tape fix works. Just keep an eye on Issue #11031 — probably the maintainers will give us a solution.
