Technical questionAccepted answer
Why do I still get a warning about "Running pip as the 'root' user" inside a Docker container?
V.D.
Aug 5
0 views1
I made a simple image of my python Django app in Docker, using this Dockerfile:
FROM python:3.8-slim-buster
WORKDIR /app
COPY requirements.txt requirements.txt
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
And building it using:
sudo docker build -t my_app:1 .
But after building the container (on Ubuntu 20.04) I get this warning:
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead
Why does it throw this warning if I am installing Python requirements inside my image? Can I actually break my system this way?
docker
python1 answer
Accepted answer · original discussion
markwalker_
PermalinkAug 5
The way your container is built doesn't add a user, so everything is done as root.
You could create a user and install to that users's home directory by doing something like this;
FROM python:3.8.3-alpine
RUN pip install --upgrade pip
RUN adduser -D myuser
USER myuser
WORKDIR /home/myuser
COPY --chown=myuser:myuser requirements.txt requirements.txt
RUN pip install --user -r requirements.txt
ENV PATH="/home/myuser/.local/bin:${PATH}"
COPY --chown=myuser:myuser . .
CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
3 question comments
Use comments to ask for clarification. Post a solution as an answer.
JustinPermalink
Aug 5
npm, and others, will also give you errors/warnings. It's good practice to not run as root, even within containers. You can create a user, as part of your Dockerfile, and use that to install/build/run.user550701Permalink
Aug 30
@KarlKnechtel If I understand correctly, the
RUN pip ... command in the Dockerfile is run by the container's root user by default, regardless of which host system user invoked docker build .... That is why the accepted answer adds a new user in the Dockerfile. @justin is saying that creating a new docker user is best practices in any case, which is very interesting and perhaps not widely known.