code review

kyaml/runfn/runfn.go

@@ -89,7 +89,7 @@ type RunFns struct {
 		filter runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter, error)
 
 	// User username used to run the application in container,
-	User string
+	User runtimeutil.ContainerUser
 }
 
 // Execute runs the command
@@ -280,8 +280,17 @@ func (r RunFns) getFunctionFilters(global bool, fns ...*yaml.RNode) (
 				// TODO(eddiezane): Provide error info about which function needs the network
 				return fltrs, errors.Errorf("network required but not enabled with --network")
 			}
-			spec.Network = r.NetworkName
+			spec.Container.Network.Name = r.NetworkName
 		}
+		// command line username has higher priority
+		if r.User != "" {
+			spec.Container.User = r.User
+		}
+		// default user is nobody
+		if spec.Container.User.IsEmpty() {
+			spec.Container.User = runtimeutil.UserNobody
+		}
+
 		c, err := r.functionFilterProvider(*spec, api)
 		if err != nil {
 			return nil, err
@@ -383,17 +392,14 @@ func (r *RunFns) ffp(spec runtimeutil.FunctionSpec, api *yaml.RNode) (kio.Filter
 		atomic.AddUint32(&r.resultsCount, 1)
 	}
 	if !r.DisableContainers && spec.Container.Image != "" {
-		// command line username has higher priority
-		user := spec.Container.User
-		if r.User != "" {
-			user = r.User
-		}
 		// TODO: Add a test for this behavior
 		cf := &container.Filter{
-			Image:         spec.Container.Image,
-			Network:       spec.Network,
-			StorageMounts: r.StorageMounts,
-			User:          user,
+			ContainerSpec: runtimeutil.ContainerSpec{
+				Image:         spec.Container.Image,
+				Network:       spec.Container.Network,
+				StorageMounts: r.StorageMounts,
+				User:          spec.Container.User,
+			},
 		}
 		cf.Exec.FunctionConfig = api
 		cf.Exec.GlobalScope = r.GlobalScope