Deployment with Docker

Container security layering with limited users

The following novel block of code in our Dockerfile is probably a little bit of a convoluted puzzle, but we will go through it together:

RUN mkdir -p $SRV_PATH && \    groupadd -r -g 350 pythonsrv && \    useradd -r -m -u 350 -g 350 pythonsrv

This is something we need to expand on multiple levels, but the first thing you need to know is that by default, Dockerfile directives are executed as root, and if at any point later you do not specify a different USER, your service will run with root credentials, which is a massive hole from a security perspective that we are trying to patch up by running our service as a limited user only. However, without the user and group defined, we cannot switch our context ...