apps in container should not run as root

[baszoetekouw]

No description provided.

[mrvanes]

https://www.howtogeek.com/devops/why-processes-in-docker-containers-shouldnt-run-as-root/

Do we want:

• Specify USER in our Dockerfiles or
• Specify user on container run?
• All containers mapped to one well-known user on the host or
• Different user for all containers?
• Align with Bart?

[mrvanes]

Mental notes:

• User needs to exist in container's /etc/passwd, so useradd in Dockerfile is required
• Container uid/gid is used for file access on host, so need to be synced, at least for writing.

To accomplish this /etc/passwd, /etc/group, /etc/shadow (and /home/{user}?) can be volume mounted to the container. Would that suffice?