{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"User in Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrey Kopylov<\/a><\/noindex>, our Technical Director, actively uses and promotes Docker. In a new article, he explains how to create users in Docker. The correct way to work with them, why users should not be left with root privileges, and how to solve the issue of mismatched indicators in Dockerfile.<\/p>\n

<\/a><\/noindex><\/p>\n

All processes in a container will run as the root user unless specified otherwise. It may seem convenient, as this user has no limitations. This is why working as root is considered unsafe. While no sane person would use root privileges on a local machine, many run processes as root in containers.<\/p>\n

<\/p>\n

There are always bugs that can allow a malicious user to escape from the container and access the host computer. Assuming the worst, we must ensure that processes within the container run under a user with no privileges on the host machine.<\/p>\n

<\/p>\n

Creating a User<\/h2>\n

<\/p>\n

Creating a user in a container is no different from creating one in Linux distributions. However, the commands may vary for different base images.<\/p>\n

<\/p>\n

For Debian-based distributions, the Dockerfile needs to include:<\/p>\n

RUN groupadd --gid 2000 node \n && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
For Alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Running processes as a user<\/h2>\n
<\/p>\n
To run all subsequent processes as the user with UID 2000, execute:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
To run all subsequent processes as the node user, execute:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
More details in the documentation<\/a><\/noindex>.<\/p>\n
<\/p>\n
Mounting volumes<\/h2>\n
<\/p>\n
When mounting volumes into the container, ensure that the user has permission to read and\/or write files. For this, the UID (GID) of the user in the container and the user outside the container, who has the corresponding file access rights, must match. The usernames do not matter.<\/p>\n
<\/p>\n
Often, on a Linux computer, the user's UID and GID are both equal to 1000. These identifiers are assigned to the first user on the computer.<\/p>\n
<\/p>\n
You can easily find your identifiers:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
You will get comprehensive information about your user.
\nReplace 2000 in the examples with your identifier, and everything will be fine.<\/p>\n
<\/p>\n
Assigning UID and GID to a user<\/h2>\n
<\/p>\n
If a user was created earlier but it's necessary to change the identifiers, this can be done as follows:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
If you are using the basic Alpine image, you need to install the shadow package:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Passing the user identifier inside the container while building the image<\/h2>\n
<\/p>\n
If your identifier matches the identifiers of everyone working on the project, it is sufficient to specify this identifier in the Dockerfile. However, user identifiers often do not match.<\/p>\n
<\/p>\n
How to achieve the desired outcome is not immediately clear. This was the most challenging aspect for me in the process of learning Docker. Many Docker users do not consider that there are different stages in the life of an image. Initially, the image is built using the Dockerfile. When launching a container from the image, the Dockerfile is no longer used.<\/p>\n
<\/p>\n
User creation should occur during the image build. The same applies to defining the user under which the processes will run. This means that we must somehow pass the UID (GID) inside the container.<\/p>\n
<\/p>\n
To use external variables in the Dockerfile, the following directives are used: ENV<\/a><\/noindex> and\u00a0ARG<\/a><\/noindex>. A detailed comparison of directives here<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
You can pass arguments via docker-compose like this:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. To master all the intricacies of Docker, it is not enough to read documentation or articles. You need to practice a lot, you need to feel Docker.<\/p>\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47User in Docker | ProHoster","description":"Andrey Kopylov, our technical director, loves, actively uses, and promotes Docker.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}