User ID Policies

ISO requirements prohibit running engines under the Administrator account. All submitted engines must meet this requirement. Engine images that are using the Administrator account will be rejected at ingestion. The official Dockerfile reference is at https://docs.docker.com/engine/reference/builder/#user

Windows Containers

Windows containers default to using the ContainerAdministrator account and so need to set a non-administrator user. The recommended account to use is ContainerUser which is available by default in Windows Server images. The command to set the user in a dockerfile is:

USER ContainerUser

Linux Containers

Linux containers default to using the root user account and need to set a non-root account. Further, Linux containers are also required to set a numeric user id as opposed to a string. In Linux the root user maps to user id 0 and so the requirement is to set a non-zero user id. An appropriate least-permissions user is the nobody account which, in many distributions, maps to the user id 65534.

The mappings between user names and user ids is found in the etc/passwd file. As an example the following command will list user information from the python base image python:3.10-slim-bullseye.

docker run python:3.10-slim-bullseye cat etc/passwd

The output of this command lists all user information from the image.

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin

A record in this file consists of seven colon seperated values. The first value is the user name and the third value is the corresponding user id. For this sample image the nobody user does indeed correspond to the user id 65534 as expected.

The command to set the user in a dockerfile is:

USER 65534