Agent WranglersINF-73Required
Run containers as a user without root
Switch to a user without root with USER before the app starts. Give that user write access only to the folders the app writes.
How to do it
Many base images ship such a user, for example node in the Node images. Create the data folder and change its owner before the USER line. Drop extra capabilities at run time, for example with cap_drop: [ALL] in Compose. The service sandbox gives the same idea for services without containers.
Examples
Dockerfile example
RUN mkdir -p /data && chown node:node /data
USER nodeHow to check
docker run --rm shop id -u prints a number other than 0.
Sources
Related rules
- OPS-33 Lock the service in a sandbox in Operations and observability
- INF-74 Never give a container control of the host in Infrastructure and environments
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/non-root-containers">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.