Now that we've removed the need to run applications injected with the istio sidecar under the privileged or anyuid SCCs, we've uncovered that the bookinfo application itself requires at least the anyuid SCC, due to badly configured file permissions. One of the containers also requires a user entry matching the user id the container is running under to be present in /etc/passwd.