Learning Docker - Second Edition

Non-root containers

As mentioned previously, the Docker containers by default run with the root privilege and so does the application that runs inside the container. This is another major concern from the security perspective because hackers can gain root access to the Docker host by hacking the application running inside the container. Docker provides a simple yet powerful solution to change the container's privilege to a non-root user and thus thwart malicious root access to the Docker host. This change to the non-root user can be accomplished using the -u or --user option of the docker run subcommand or the USER instruction in the Dockerfile.

In this section, we will demonstrate by showing you the default root privilege of the Docker container ...