Our image uses a non-root USER, but Docker still runs as root on the host

A worked deployment uses a Dockerfile USER instruction and runs the application as UID 1001. An audit of the host still shows a rootful Docker daemon. The team assumed the Dockerfile changed both processes. What boundary did the instruction actually change?

The USER instruction selects the user for the application process inside the container. It does not change the daemon’s host identity. Rootless Docker is a separate configuration that runs the daemon and containers within an unprivileged user-namespace arrangement.

Use docker context show and docker info to inspect the daemon your client reaches. If a rootless migration is desired, review Docker’s prerequisites and plan persistent storage, ports, service startup and rollback. Do not disable the existing daemon on a production host before preparing the replacement.

Can we keep the non-root application while planning the host migration?

Yes. They are separate controls. Preserve the application restriction and evaluate the operational requirements of rootless Docker independently.

Avoid mounting the Docker socket into the application as a convenience workaround. That would create a powerful management path and undermine the intended isolation.

Our image uses a non-root USER, but Docker still runs as root on the host

Sources & further reading

2 answers

Your perspective belongs here.

0 question comments