3 ms·
Massive downside: You run your app as root or you have to do nasty mounts of /etc/passwd and /etc/group from your host
by rmoriz 9y ago
Massive downside: You run your app as root or you have to do nasty mounts of /etc/passwd and /etc/group from your host
- Intermernet 9y agoYou can run a Docker container as a particular user. https://docs.docker.com/engine/reference/builder/#user https://docs.docker.com/engine/reference/builder/#user You can use `setcap` to grant capabilities to the binary or the `pam_cap` module if you need to do capabilities per user. I haven't run across the need to run most containers as root for a while now.
- embano1 9y agoYup, in the end it´s an OS process and all rules apply. I did not care too much about Dockerfile best practices in my article. Good point, should at least have used "user <!root>".
- lizxrice 9y agoYou don't have to mount the host versions - you can create container-specific ones. See https://medium.com/@lizrice/non-privileged-containers-based-on-the-scratch-image-a80105d6d341 https://medium.com/@lizrice/non-privileged-containers-based-...