Running containers as non-root in Docker - Cheat Sheet & Quick Revision

Recall & Review

beginner

Why should you avoid running Docker containers as root?

Running containers as root can create security risks because if the container is compromised, the attacker may gain root access to the host system. Running as non-root limits these risks.

beginner

How do you specify a non-root user in a Dockerfile?

Use the USER instruction followed by the username or UID. For example, USER appuser switches to the user appuser inside the container.

beginner

What command can you use to check the current user inside a running container?

Run whoami inside the container shell to see the current user name.

intermediate

What is the purpose of the --user flag in docker run?

The --user flag lets you run the container process as a specific user or UID without changing the Dockerfile. For example, docker run --user 1001 myimage runs as user ID 1001.

intermediate

What should you do if your application needs write access to a directory but runs as non-root?

Make sure the directory permissions allow the non-root user to write. You can set ownership or permissions on the directory during image build or at runtime.

What is the default user inside a Docker container if not specified?

A appuser

B nobody

C docker

D root

By default, Docker containers run as the root user unless a different user is specified.

Which Dockerfile instruction sets the user for running commands inside the container?

A USER

B ENTRYPOINT

C CMD

D RUN

The USER instruction sets the user name or UID for running subsequent commands and the container process.

How can you run a container as a non-root user without modifying the Dockerfile?

A Use the --user flag with docker run

B Change the ENTRYPOINT

C Use docker exec

D Modify the image layers

The --user flag allows specifying the user at runtime without changing the Dockerfile.

What happens if a non-root user tries to write to a directory without permission inside a container?

A The write succeeds

B Permission denied error occurs

C The container crashes

D Docker automatically grants permission

Without proper permissions, the non-root user will get a permission denied error when trying to write.

Why is running containers as non-root considered a best practice?

A It uses less memory

B It improves container startup speed

C It reduces security risks

D It enables automatic updates

Running as non-root limits the damage if the container is compromised, improving security.

Explain how to run a Docker container as a non-root user and why it is important.

Think about user permissions and container security.

Describe what steps you would take if your containerized app needs to write files but runs as a non-root user.

Focus on file system permissions and user identity.