---
title: "Run containers as a user without root · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/containers/non-root-containers
updated: 2026-10-20
licence: "All rights reserved"
---

# Run containers as a user without root

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Containers](https://agentwranglers.se/playbook/operations/containers)
- Rule: Switch to a user without root with `USER` before the app starts. Give that user write access only to the folders the app writes.
- How: Many base images ship such a user, for example `node` in the Node images. Create the data folder and change its owner before the `USER` line. Drop extra capabilities at run time, for example with `cap_drop: [ALL]` in Compose. The [service sandbox](https://agentwranglers.se/playbook/operations/running-the-service/service-sandbox) gives the same idea for services without containers.
- Check: `docker run --rm shop id -u` prints a number other than 0.

Example:

```dockerfile
RUN mkdir -p /data && chown node:node /data
USER node
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/non-root-containers`.

- Previous: [Keep build tools out of the runtime image](https://agentwranglers.se/playbook/operations/containers/multi-stage-builds)
- Next: [Never give a container control of the host](https://agentwranglers.se/playbook/operations/containers/no-privileged-containers)
- [Containers](https://agentwranglers.se/playbook/operations/containers)