CodeBlanks Logo Icon CodeBlanks
Login Register

Switching users

Learn to switch the container user with -u.

Changing the user

Processes in a container run as root by default. If a vulnerability is found, the attacker gains root privileges inside the container. That is why an unprivileged user is created in the Dockerfile and switched to with USER:

FROM node:20-alpine
WORKDIR /app
COPY --chown=node:node . .
USER node
CMD ["node", "server.js"]

Official Node images include a ready node user.

Creating a user and -u

In images without a ready user, the user is created with RUN. At run time, the user can be changed with -u user or -u UID:GID:

FROM python:3.12-slim
RUN useradd --create-home --uid 1000 app
USER app

$ docker run --rm -u 1000:1000 alpine id
uid=1000 gid=1000 groups=1000

Listening on ports below 1024 requires root; with an unprivileged user you make the application listen on a high port like 8080.

Practice Python with an unprivileged user

Write a Dockerfile based on python:3.12-slim: create a user with useradd --create-home --uid 1000 app; WORKDIR /app; copy the files with --chown=app:app (COPY --chown=app:app . .); USER app; CMD is python app.py in exec form.

Starter code

terminal
# buraya yaz

Sample solution

terminal
FROM python:3.12-slim
RUN useradd --create-home --uid 1000 app
WORKDIR /app
COPY --chown=app:app . .
USER app
CMD ["python", "app.py"]

Expected output

[+] Building 3.8s (9/9) FINISHED
 => naming to docker.io/library/api:latest done

Questions and answers

Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.

1 What is the main reason to run a non-root user in a container?

  • To be able to open ports
  • To reduce the damage in case of a vulnerability Correct answer
  • To speed up the application
  • To shrink the image

Explanation: The principle of least privilege applies to containers too.

2 Run the following instructions as the app user.

Question 
____ app
Answer 
USER app

Explanation: USER sets the user for the following RUN, CMD and ENTRYPOINT.

3 Match.

Term Meaning
USER User in the Dockerfile
-u 1000:1000 UID:GID at run time
useradd Creates a user
port 8080 Needs no root

All lessons in Beginner

1 What is Docker?

  1. What is Docker?
  2. Containers and virtual machines
  3. Images and containers
  4. Docker architecture
  5. Use cases
  6. Summary - What is Docker

2 Installation and first commands

  1. Installing Docker
  2. docker version
  3. docker info
  4. The hello-world container
  5. Docker Desktop
  6. Summary - Installation

3 First container

  1. docker run basics
  2. Running in the background
  3. docker ps
  4. docker stop and rm
  5. docker logs
  6. Summary - First container

4 Dockerfile basics

  1. What is a Dockerfile?
  2. The FROM instruction
  3. The RUN instruction
  4. COPY and ADD
  5. CMD and ENTRYPOINT
  6. Summary - Dockerfile

5 Build and images

  1. docker build
  2. Tagging images
  3. Build context
  4. Layers and cache
  5. .dockerignore
  6. Summary - Build

6 docker run options

  1. Interactive mode
  2. Naming containers
  3. Restart policy
  4. Working directory
  5. Switching users
  6. Summary - docker run

7 Image management

  1. docker images
  2. docker rmi
  3. docker pull
  4. docker push
  5. docker tag
  6. Summary - Image management

8 Port mapping

  1. The port concept
  2. The -p flag
  3. Multiple ports
  4. Random ports
  5. IP binding
  6. Summary - Port mapping

9 Volumes and data

  1. Data persistence
  2. Named volumes
  3. The -v flag
  4. Bind mounts
  5. Volume management
  6. Summary - Volumes

10 Environment variables

  1. The -e flag
  2. The ENV instruction
  3. The ARG instruction
  4. env-file
  5. The WORKDIR instruction
  6. Summary - Environment

11 Project: docker-compose

  1. Compose design
  2. Service definition
  3. Database service
  4. Volume and network
  5. Putting it together - compose

12 Docker Hub and registry

  1. What is Docker Hub?
  2. docker login
  3. Searching images
  4. Official images
  5. Private registry
  6. Summary - Registry

13 Network basics

  1. Network drivers
  2. docker network ls
  3. Bridge network
  4. Container connectivity
  5. Publishing ports
  6. Summary - Network

14 Beginner final

  1. Challenge - Dockerfile
  2. Challenge - Build and run
  3. Challenge - Volume
  4. Challenge - Compose
  5. Challenge - Beginner project