# Running Sombra as a non-root user (/docs/sombra/deploying/customizing-sombra/non-root-user)

<Callout type="warn">
  Running Sombra as a non-root user is an experimental feature. If a feature is not working as expected, please contact support.
</Callout>

## Custom Functions [#custom-functions]

Sombra spawns Custom Function processes with a separate, locked down user. However, when Sombra is not run as the root user, it cannot spawn a process with a different user. Since you're already running Sombra as a non-root user, we recommend running the Custom Function from the same user.

1. Set the `CUSTOM_FUNCTION_EXECUTION_UID` environment variable to the UID of the user running Sombra.
2. Set the `CUSTOM_FUNCTION_EXECUTION_GID` environment variable to the GID of the user running Sombra.
3. Mount a directory writable by the non-root user to `/.cache/deno` to allow for Custom Functions to cache dependencies required at runtime.
   1. You can optionally override the cache directory by setting `CUSTOM_FUNCTION_DENO_DIR` to a writable path of your choice.

For example, if your Kubernetes cluster has a security context like this:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: sombra-fdff6cdbc-b8vd5
  # ...
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    runAsNonRoot: true
```

Then you should set:

```text
CUSTOM_FUNCTION_EXECUTION_UID=1000
CUSTOM_FUNCTION_EXECUTION_GID=3000
```