Docker Course
Docker
/
Intermediate

Running as Non-Root User

Definition

The security best practice of explicitly changing the active user inside the container from the default `root` superuser to a highly restricted standard user before the main application starts.

Explain Like I'm New

By default, Docker containers run as the all-powerful 'Administrator'. If a hacker breaks in, they are the Administrator. By explicitly telling Docker to run as 'Guest', the hacker breaks in and finds they don't have permission to do anything.

Real World Example

In a Node.js Dockerfile, the developer writes `USER node` at the very bottom. When the container starts, it drops its superuser privileges. If an attacker exploits the app and tries to run `rm -rf /`, the system rejects the command due to insufficient permissions.

Common Use Cases

  • •Dockerfile best practices
  • •Compliance requirements

Interview Questions

basic

  • What is the default User inside a Docker container if you don't specify one in the Dockerfile?

intermediate

  • Why do you usually see the `USER` command placed at the absolute bottom of a Dockerfile, rather than the top?

Flash Cards

Question

Default User?

Click to reveal answer
Answer

The `root` user (the ultimate superuser).

Question

Why at the bottom?

Click to reveal answer
Answer

Because installing software (like `apt-get install python`) requires `root` privileges. You must leave the Dockerfile as root while building the image, and then drop down to the restricted user right before the `CMD` instruction executes the live app.