cf push hangs on 'Instance starting...' when trying to push a Docker Image app that runs as root

[Birdrock]

When pushing a Docker Image that does not have a USER instruction, or specifies root, with cf push app -o <app-image>, the CLI hangs with the following:

cf push nginx -o nginx                     
Pushing app nginx to org o / space s as admin...

Staging app and tracing logs...

Waiting for app nginx to start...

Instances starting...
Instances starting...
Instances starting...
Instances starting...
Instances starting...
Instances starting...
Instances starting...
Instances starting...
Instances starting...

The behavior repeats until timeout.

cf logs --recent shows the following:

cf logs nginx --recent
Retrieving logs for app nginx in org o / space s as admin...

   2020-10-06T15:44:17.00-0700 [API/0] OUT Creating droplet for app with guid e8cc8497-c414-4233-9cdf-a3e26764501d
   2020-10-06T15:44:17.00-0700 [API/0] OUT Updated app with guid e8cc8497-c414-4233-9cdf-a3e26764501d ({:droplet_guid=>"60684061-1dca-47bd-be8d-bfc60ad9dd45"})
   2020-10-06T15:44:23.00-0700 [API/0] OUT Process has crashed with type: "web"
   2020-10-06T15:44:23.00-0700 [API/0] OUT App instance exited with guid e8cc8497-c414-4233-9cdf-a3e26764501d payload: {"instance"=>"nginx-s-7820289c67-0", "index"=>0, "cell_id"=>"", "reason"=>"CreateContainerConfigError", "exit_description"=>"container has runAsNonRoot and image will run as root", "crash_count"=>0, "crash_timestamp"=>0, "version"=>"a3d1920d-6334-4073-a51c-fc0d02b4d63d"}

I would expect the CLI to provide a message that the container cannot be run, and return.

CC: @paulcwarren

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/177785302

The labels on this github issue will be updated when the story is started.

[bosh-admin-bot]

This issue was marked as Stale because it has been open for 21 days without any activity. If no activity takes place in the coming 7 days it will automatically be close. To prevent this from happening remove the Stale label or comment below.