runAsUser: 0 silently dropped without privileged: true

Component

agent

Describe the bug

runAsUser: 0 is silently dropped/ignored when the step doesn't have privileged: true set

Steps to reproduce

when:
  - event: pull_request
  - event: push
    branch: main

steps:
  mirror-images:
    # renovate: datasource=docker depName=ghcr.io/regclient/regctl
    image: ghcr.io/regclient/regctl:v0.11.5-alpine
    backend_options:
      kubernetes:
        # regclient image runs as non-root; need root to apk add yq/jq.
        securityContext:
          runAsUser: 0
          runAsGroup: 0
    commands:
      - apk add --no-cache yq jq git
      - sh .ci/mirror-images.sh

Expected behavior

It appears this was originally done for "security" purposes but at the very least I'd expect some sort of log or error somewhere this is happening.

Ideally this configuration is supported--privileged: true is a radically different security posture than uid 0 with privileges dropped. It is especially much different when running userns where you're not even real root on the host anyway

System Info

https://github.com/nijave/vmubtkube-a/tree/main/woodpecker

3.15.0

Additional context

What is especially odd is I can change to a different Docker image that defaults to run as root and everything works fine. Blocking runAsUser: 0 doesn't seem to make much sense given I can trivially change the runner image to one that does the same thing in the image manifest (vs k8s manifest)

To create a more reasonable security boundary, runAsNonRoot: true should be injected although I still highly disagree this should have any linkage to securityContext.privileged: true

Validations

• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Checked that the bug isn't fixed in the next version already [https://woodpecker-ci.org/versions]