Running containers as non-root in Docker - Mini Project: Build & Apply

Running Containers as Non-Root User

📖 Scenario: You are deploying a simple web application using Docker. For security reasons, you want the container to run as a non-root user instead of the default root user.

🎯 Goal: Learn how to create a Dockerfile that sets up a non-root user and runs the container with that user.

📋 What You'll Learn

Create a Dockerfile with a base image

Add a non-root user to the Dockerfile

Set the container to run as the non-root user

Verify the container runs as the non-root user

💡 Why This Matters

🌍 Real World

Running containers as non-root users improves security by limiting permissions inside the container, reducing risks if the container is compromised.

💼 Career

Many DevOps and security roles require knowledge of container security best practices, including running containers as non-root users.

1

Create a Dockerfile with a base image

Create a file named Dockerfile and write a line to use the python:3.12-slim base image.

Docker

# Write the FROM instruction to use python:3.12-slim
# Your code here

Need a hint?

The FROM instruction sets the base image for your Dockerfile.

2

Add a non-root user

Add lines to the Dockerfile to create a new user named appuser with user ID 1001 and create a home directory for this user.

Docker

FROM python:3.12-slim
# Add a user named appuser with UID 1001
# Your code here

Need a hint?

Use RUN useradd -m -u 1001 appuser to add the user with a home directory.

3

Set the container to run as the non-root user

Add a line to the Dockerfile to switch the user to appuser so the container runs as this user.

Docker

FROM python:3.12-slim
RUN useradd -m -u 1001 appuser
# Set the user to appuser
# Your code here

Need a hint?

The USER instruction sets the user for running the container.

4

Build and run the container to verify the user

Write the Docker commands to build the image named nonrootapp from the current directory and run a container that prints the current user with whoami.

Docker

FROM python:3.12-slim
RUN useradd -m -u 1001 appuser
USER appuser
# Build the image and run the container to print the user
# Your code here

Need a hint?

Use docker build -t nonrootapp . to build and docker run --rm nonrootapp whoami to check the user.