Create a low-rights user in the base image

[haniamr]

Same practice as what the "node" images do, can you create a low-rights user in the base images so Dockerfiles can simply switch to it to avoid running as root?

Something like: RUN useradd --create-home pythonuser

[wglambert]

You can use --user to run the image as any UID or username

For example you can create the user python on the host and mount /etc/passwd into the container read-only, then run with --user python and it will run as user python's UID

$ cat /etc/passwd | grep -i python
python:x:1000:1000:Linux User,,,:/home/python:/bin/bash

$ docker run -it --rm -v /etc/passwd:/etc/passwd:ro --user 1000 python bash
python@ea9814723f6f:/$ ps aux
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
python        1  0.3  0.0   5748  3556 pts/0    Ss   21:17   0:00 bash
python        6  0.0  0.0   9388  3000 pts/0    R+   21:17   0:00 ps aux

python@ea9814723f6f:/$ whoami
python

python@ea9814723f6f:/$ echo $UID
1000

[bwateratmsft]

I think what he means is to create a user in the base image, similar to how the node images create a user called node. This allows for some standardization, and anyone wanting to use it can add USER node to their Dockerfile without needing to do a RUN useradd ... call.

(Or, do docker run -u node ..., etc. There's a lot of ways. 😄)

[yosifkit]

I don't see a need to add such a user. A user id doesn't need to be created to be used by docker:

$ docker run -d -u 10001:10001 custom-python
$ # or as your own user
$ docker run -d -u "$(id -u)":"$(id -g)" custom-python

If you want a fairly standard low-rights user (that is already in /etc/passwd of all the python images), then you can use nobody (and nogroup).

[bwateratmsft]

None of those users have home directories. For .NET Core for instance, a home directory is needed to enable debugging, so we (the Docker extension for VSCode) have to create a user.

@haniamr Off the top of my head I can't think of a Python scenario that requires a home directory, but it isn't farfetched--can you think of one?