Running containers as non-root in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this Dockerfile command?

Consider this Dockerfile snippet that sets a non-root user:

FROM alpine:latest
RUN adduser -D appuser
USER appuser
RUN whoami

What will be the output of the whoami command inside the container?

Docker

FROM alpine:latest
RUN adduser -D appuser
USER appuser
RUN whoami

A appuser

B root

C nobody

D docker

💡 Hint

The USER instruction changes the user for following commands.

The USER instruction switches the user to 'appuser'. So the 'whoami' command runs as 'appuser' and outputs 'appuser'.

❓ Configuration

intermediate

Which Dockerfile snippet correctly runs a process as non-root user?

You want to run your application inside a container as a user named 'appuser' with UID 1001. Which Dockerfile snippet correctly creates this user and runs the app as that user?

A

RUN adduser -u 1001 appuser
USER root
CMD ["./app"]

B

RUN useradd -m -u 1001 appuser
USER root
CMD ["./app"]

C

RUN adduser appuser
USER 1001
CMD ["./app"]

D

RUN adduser -u 1001 appuser
USER appuser
CMD ["./app"]

💡 Hint

The USER instruction sets the user for running commands and the app.

Option D creates the user with UID 1001, switches to that user, and runs the app as that user. Other options either keep root or use wrong USER syntax.

❓ Troubleshoot

advanced

Why does this container fail to start when running as non-root?

You have this Dockerfile snippet:

FROM node:18
RUN useradd -m appuser
USER appuser
CMD ["node", "app.js"]

The container fails with a permission error when trying to access /app directory. What is the most likely cause?

A The CMD syntax is invalid for non-root users.

B The /app directory is owned by root and appuser has no permission to access it.

C The USER instruction must be root to run node apps.

D The useradd command did not create the user correctly.

💡 Hint

Check directory ownership and permissions for the app user.

The appuser cannot access /app if it is owned by root without proper permissions. This causes permission errors when running as non-root.

🔀 Workflow

advanced

What is the correct order to run these Docker commands to build and run a container as non-root?

Arrange these commands in the correct order to build an image and run a container as a non-root user named 'appuser':

A 3,4,1,2

B 4,3,1,2

C 1,3,4,2

D 3,1,4,2

💡 Hint

You must create the Dockerfile with user setup before building the image.

First create the Dockerfile with USER and user creation, then build the image, then run the container.

✅ Best Practice

expert

Which practice is best for running containers as non-root in production?

Select the best practice for running containers as non-root users in a secure production environment.

A Run containers as random users without setting file permissions.

B Run containers as root but restrict network access with firewall rules.

C Create a dedicated user with a fixed UID and set proper file permissions in the image.

D Use the default root user but disable all container capabilities.

💡 Hint

Security best practices recommend fixed users and permissions.

Creating a dedicated user with fixed UID and setting file permissions ensures predictable security and avoids permission issues.