Running containers as non-root in Docker - Step-by-Step Execution

Process Flow - Running containers as non-root

Start Dockerfile

↓

Set USER to non-root

↓

Build Image

↓

Run Container

↓

Container runs as non-root

↓

Verify user inside container

↓

Exit

This flow shows how to set a non-root user in a Dockerfile, build the image, run the container, and verify the user inside.

Execution Sample

Docker

FROM ubuntu:latest
RUN useradd -m appuser
USER appuser
CMD ["whoami"]

This Dockerfile creates a user 'appuser', switches to it, and runs 'whoami' to show the current user.

Process Table

Step	Action	Command/Instruction	Result/Output
1	Start from base image	FROM ubuntu:latest	Base image ubuntu:latest pulled
2	Create new user	RUN useradd -m appuser	User 'appuser' created
3	Set user for container	USER appuser	Default user set to 'appuser'
4	Set default command	CMD ["whoami"]	Command to run 'whoami' set
5	Build image	docker build -t test-nonroot .	Image 'test-nonroot' built successfully
6	Run container	docker run --rm test-nonroot	Output: appuser
7	Verify user	Output of 'whoami'	appuser
8	Exit	Container stops after command	Container exited
9	End	No more steps	Execution complete

💡 Container runs command as 'appuser' and exits, confirming non-root execution

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 6	Final
USER	root	root	appuser	appuser	appuser
Container State	Not built	Image built	Image built	Running as appuser	Exited

Key Moments - 3 Insights

Why do we need to add a new user instead of just switching USER to a non-root name?

Because the user must exist inside the container. Step 2 creates 'appuser', so step 3 can switch to it. Without creation, USER would fail.

What happens if we don't set USER in the Dockerfile?

The container runs as root by default (see Step 1 and Step 6). Setting USER changes the default user for running commands.

Why does the container exit after running 'whoami'?

Because CMD runs a single command and then stops. The container lifecycle ends after the command completes (Step 8).

Visual Quiz - 3 Questions

Look at the execution table, what user is the container running as at Step 6?

A appuser

B nobody

C root

D docker

💡 Hint

Check the 'Result/Output' column at Step 6 showing 'Output: appuser'

At which step is the new user 'appuser' created inside the image?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at the 'Action' and 'Command/Instruction' columns; useradd runs at Step 2

If we remove the USER instruction, what will be the output at Step 6?

A appuser

B root

C nobody

D Error

💡 Hint

Without USER set, container runs as root by default (see Step 1 and Step 6)

Concept Snapshot

Docker containers run as root by default.
To run as non-root, create a user inside the image with 'useradd'.
Use 'USER username' in Dockerfile to switch user.
Run container; commands execute as that user.
Verify with 'whoami' inside container.
This improves security by limiting privileges.

Full Transcript

This visual execution shows how to run Docker containers as non-root users. First, the Dockerfile starts from a base image. Then it creates a new user named 'appuser' using 'useradd'. Next, it sets the default user to 'appuser' with the USER instruction. The CMD runs 'whoami' to print the current user. When building and running the container, the output confirms the container runs as 'appuser' instead of root. The container exits after running the command. Key points include the need to create the user before switching, the default root user if USER is not set, and that containers stop after the CMD finishes. This method improves container security by avoiding running as root.