4 ms·

Does anyone have an example of adding a non-root user in the Dockerfile as mentioned, that they like to use in a cookie-cutter approach?

nickjj 6y ago
I have one here: https://github.com/nickjj/docker-flask-example/blob/ca1d48499a4007378bbe363bd5dc117c1a33cc3a/Dockerfile#L47 https://github.com/nickjj/docker-flask-example/blob/ca1d4849... The basic idea is you create a user in your Dockerfile, switch to that user with the USER instruction and now future instructions in your Dockerfile will be run as that user. Also when COPY'ing you'll want to add --chown myuser:myuser too. The above Dockerfile shows examples of all of that. I'm not a fan of customizing the UID / GID because then in development with volumes you can get into trouble. Technically you could set UID + GID as build arguments but in practice I never ran into a scenario where this was needed because 99% of the time on a dev box your uid:gid will be 1000:1000 and in production chances are you are in control of provisioning your VPS so your deploy user will be 1000:1000 too. Also you probably won't be using volumes, but if you did they will work out of the box with the above example.
LucidLynx 6y ago
Maybe you could be interested in this article: https://www.rockyourcode.com/run-docker-nginx-as-non-root-user/ https://www.rockyourcode.com/run-docker-nginx-as-non-root-us...
sdwolfz 6y ago
Here's my approach: https://www.codrut.pro/snippets/docker-images-basic-ruby-setup/ https://www.codrut.pro/snippets/docker-images-basic-ruby-set... [Edit] This is what I use for local development docker images. Note: I disagree with this article, none of the things listed are "best" practices in my opinion... more like random practices somebody prefers. Use what you like.
- kubanczyk 6y ago
  OP's version: > UIDs below 10,000 are a security risk on several systems, because if someone does manage to escalate privileges outside the Docker container their Docker container UID may overlap with a more privileged system user's UID granting them additional permissions. > [...] there may sometimes be reasons to not do what is described here, but if you don't know then this is probably what you should be doing. Your version: > Use what you like. > UID=1000
  - sdwolfz 6y ago
    I should probably also mention this example is for docker images that I use for local development with a shared file mount having the same UID/GID as your host, so you don't have to `chown` all the time while developing.
- BossingAround 6y ago
  > more like random practices somebody prefers Surely, if "X" has posed a security flaw in the past, and "Y" achieves the same as "X" without being vulnerable to the exploits (e.g. the UID advice), then "Y" is objectively better and not a matter of style, is it not?
rualca 6y ago
Docker's official article on best practices has a section dedicated to showing how to add user accounts. https://docs.docker.com/develop/develop-images/dockerfile_best-practices/ https://docs.docker.com/develop/develop-images/dockerfile_be...

nickjj 6y ago

I have one here: https://github.com/nickjj/docker-flask-example/blob/ca1d48499a4007378bbe363bd5dc117c1a33cc3a/Dockerfile#L47 https://github.com/nickjj/docker-flask-example/blob/ca1d4849... The basic idea is you create a user in your Dockerfile, switch to that user with the USER instruction and now future instructions in your Dockerfile will be run as that user. Also when COPY'ing you'll want to add --chown myuser:myuser too. The above Dockerfile shows examples of all of that. I'm not a fan of customizing the UID / GID because then in development with volumes you can get into trouble. Technically you could set UID + GID as build arguments but in practice I never ran into a scenario where this was needed because 99% of the time on a dev box your uid:gid will be 1000:1000 and in production chances are you are in control of provisioning your VPS so your deploy user will be 1000:1000 too. Also you probably won't be using volumes, but if you did they will work out of the box with the above example.

LucidLynx 6y ago

Maybe you could be interested in this article: https://www.rockyourcode.com/run-docker-nginx-as-non-root-user/ https://www.rockyourcode.com/run-docker-nginx-as-non-root-us...

sdwolfz 6y ago

Here's my approach: https://www.codrut.pro/snippets/docker-images-basic-ruby-setup/ https://www.codrut.pro/snippets/docker-images-basic-ruby-set... [Edit] This is what I use for local development docker images. Note: I disagree with this article, none of the things listed are "best" practices in my opinion... more like random practices somebody prefers. Use what you like.

kubanczyk 6y ago
OP's version: > UIDs below 10,000 are a security risk on several systems, because if someone does manage to escalate privileges outside the Docker container their Docker container UID may overlap with a more privileged system user's UID granting them additional permissions. > [...] there may sometimes be reasons to not do what is described here, but if you don't know then this is probably what you should be doing. Your version: > Use what you like. > UID=1000
- sdwolfz 6y ago
  I should probably also mention this example is for docker images that I use for local development with a shared file mount having the same UID/GID as your host, so you don't have to `chown` all the time while developing.
BossingAround 6y ago
> more like random practices somebody prefers Surely, if "X" has posed a security flaw in the past, and "Y" achieves the same as "X" without being vulnerable to the exploits (e.g. the UID advice), then "Y" is objectively better and not a matter of style, is it not?

rualca 6y ago

Docker's official article on best practices has a section dedicated to showing how to add user accounts. https://docs.docker.com/develop/develop-images/dockerfile_best-practices/ https://docs.docker.com/develop/develop-images/dockerfile_be...