Docker Docker Security Running Containers as NonRoot USER in Dockerfile user

1. Core Command / Concept

Run containers as non-root users to improve security and isolation. Use the USER instruction in the Dockerfile or the --user flag with docker run.

2. Step-by-Step

1. Create a new Dockerfile with a USER instruction: echo "FROM ubuntu:latest\nUSER myuser" > Dockerfile
2. Build the Docker image: docker build -t myimage .
3. Run the container with the --user flag: docker run -it --user myuser myimage
4. Check the container's user ID: docker exec -it mycontainer id -u
5. ⚠️ Delete the container: docker rm mycontainer
6. Clean up the image: docker rmi myimage

3. Real Commands with Examples

Example 1: Run a container as a non-root user

Purpose: Run a container with the user ID 1001.
Command: docker run -it --user 1001 myimage Brief explanation of flags: -it runs the container in interactive mode, --user 1001 sets the user ID to 1001.

Example 2: Use the USER instruction in the Dockerfile

Purpose: Build an image with a custom user.
Command: docker build -t myimage . Brief explanation of flags: docker build builds the image from the Dockerfile, -t myimage tags the image with the name myimage.

Example 3: Run a container as a non-root user with a specific group

Purpose: Run a container with the user ID 1001 and group ID 1002.
Command: docker run -it --user 1001:1002 myimage Brief explanation of flags: --user 1001:1002 sets both the user ID and group ID to 1001 and 1002, respectively.

4. Common Errors

Error 1: User ID not found

Error message or symptom: docker: Error response from daemon: user not found: 1001.
Why it happens: The user ID 1001 does not exist in the container's user database.
One-line fix: docker run -it --user 1001:1001 myimage (use the same user ID for both user and group).

Error 2: Group ID not found

Error message or symptom: docker: Error response from daemon: group not found: 1002.
Why it happens: The group ID 1002 does not exist in the container's group database.
One-line fix: docker run -it --user 1001:1001 myimage (use the same user ID for both user and group).

Error 3: User ID out of range

Error message or symptom: docker: Error response from daemon: user ID out of range: 65536.
Why it happens: The user ID 65536 is out of the range of valid user IDs (0-65535).
One-line fix: docker run -it --user 1000:1001 myimage (use a valid user ID).

5. Quick Checks

Scenario 1: Check the container's user ID

Situation: You want to verify that the container is running with the correct user ID.
Command: docker exec -it mycontainer id -u Correct response: 1001.

Scenario 2: Check the container's group ID

Situation: You want to verify that the container is running with the correct group ID.
Command: docker exec -it mycontainer id -g Correct response: 1001.

Scenario 3: Check the container's user and group IDs

Situation: You want to verify that the container is running with the correct user and group IDs.
Command: docker exec -it mycontainer id -u -g Correct response: 1001 1001.

6. Last-Minute Reference

• The USER instruction in the Dockerfile sets the default user for the container.
• The --user flag with docker run sets the user ID for the container.
• The --user flag with docker run can also set the group ID.
• The id command in the container shows the user and group IDs.
• The docker exec command runs a command in the container.
• The docker rm command deletes a container.
• The docker rmi command deletes an image.
• ? Verify with docker version that you are using a version that supports non-root containers.
• ⚠️ Be careful when deleting containers, as this will delete all stopped containers.
• ⚠️ Be careful when deleting images, as this will delete all images, including those that are not used.
• The --user flag with docker run can be used to set the user ID and group ID.
• The --user flag with docker run can be used to set the user ID and group ID separately.