Docker
/Intermediate
Running as Non-Root User
Definition
The security best practice of explicitly changing the active user inside the container from the default `root` superuser to a highly restricted standard user before the main application starts.
Explain Like I'm New
By default, Docker containers run as the all-powerful 'Administrator'. If a hacker breaks in, they are the Administrator. By explicitly telling Docker to run as 'Guest', the hacker breaks in and finds they don't have permission to do anything.
Real World Example
In a Node.js Dockerfile, the developer writes `USER node` at the very bottom. When the container starts, it drops its superuser privileges. If an attacker exploits the app and tries to run `rm -rf /`, the system rejects the command due to insufficient permissions.
Common Use Cases
- •Dockerfile best practices
- •Compliance requirements
Interview Questions
basic
- What is the default User inside a Docker container if you don't specify one in the Dockerfile?
intermediate
- Why do you usually see the `USER` command placed at the absolute bottom of a Dockerfile, rather than the top?