Just a note, being able to 'docker exec' into a couchbase-server container and install packages as root (e.g. tcpdump and iputils) is quite a good thing.  I'd rather we not lose this debug functionality if at all possible.

Simon,

This is specifically for openshift. I haven't looked into the details yet so I'm not sure exactly what we should do, but right now we need to add extra privileges (oc adm policy add-scc-to-user anyuid system:serviceaccount:myproject:default) for a user to run our containers. This isn't usually required by default and some users are uncomfortable needing to do this. We have separate openshift containers and I think using those would solve this issue, but I haven't had a chance to test it out yet.