Agent Wranglers

Containers Required

Run containers as a user without root

Switch to a user without root with USER before the app starts. Give that user write access only to the folders the app writes.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Many base images ship such a user, for example node in the Node images. Create the data folder and change its owner before the USER line. Drop extra capabilities at run time, for example with cap_drop: [ALL] in Compose. The service sandbox gives the same idea for services without containers.

Example

RUN mkdir -p /data && chown node:node /data
USER node

How to check

docker run --rm shop id -u prints a number other than 0.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/non-root-containers.