4.1 Create a user for the container


Create a non-root user for the container in the Dockerfile for the container image.


It is a good practice to run the container as a non-root user, if possible. Though user namespace mapping is now available, if a user is already defined in the container image, the container is run as that user by default and specific user namespace remapping is not required.


Ensure that the Dockerfile for the container image contains below instruction:

USER <username or ID>

where username or ID refers to the user that could be found in the container base image. If there is no specific user created in the container base image, then add a useradd command to add the specific user before USER instruction.

For example, add the below lines in the Dockerfile to create a user in the container:

RUNuseradd -d /home/username -m -s /bin/bash username

USER username

Note: If there are users in the image that the containers do not need, consider deleting them. After deleting those users, commit the image and then generate new instances of containers for use.



Default Value:

By default, the containers are run with root privileges and as user root inside the container.

See Also


Item Details


References: 800-53|AC-6

Plugin: Unix

Control ID: f12321cc71e4df31bd607e4c92227ed67fd89ada3c5be2f1207535582633861c