Docker containers are powerful tools for isolating and running applications, but they often run as the root user by default. Security best practices recommend minimizing the use of root privileges to reduce potential vulnerabilities. In this blog post, we’ll explore how to run Docker as a non-root user using the lightweight BusyBox image.

The Importance of Running Docker as a Non-Root User

Running Docker containers as a non-root user enhances security by limiting potential damage in case of security vulnerabilities. By default, Docker requires elevated privileges, but adopting a non-root approach is crucial in securing containerized environments.

Step 1: Create a Dockerfile with a Non-Root User

Let’s create a Dockerfile that utilizes BusyBox and sets up a non-root user:

# Use BusyBox as the base image
FROM busybox

# Create a non-root user and group
RUN addgroup -S mygroup && adduser -S myuser -G mygroup

# Switch to the non-root user
USER myuser

# Create a sample file in the user's home directory
RUN echo "Hello, Docker non-root user!" > /home/myuser/sample.txt

Command to run upon container start

CMD cat /home/myuser/sample.txt`

In this example, we create a non-root group (mygroup) and user (myuser). We then switch to the myuser for subsequent commands. A sample file is created in the user’s home directory.

Step 2: Build the Docker Image

Navigate to the directory containing your Dockerfile and execute the following command to build the Docker image:

docker build -t my-non-root-app .

This command builds an image named my-non-root-app using the specified Dockerfile.

Step 3: Run the Docker Container

Now, run a container based on the newly created image:

docker run my-non-root-app

This command starts a container that executes the CMD command, displaying the content of the sample file. The container runs as the non-root user, enhancing security.

Step 4: Verification

To verify that the container is indeed running as a non-root user, you can use the following command:

docker exec -it <container_id_or_name> id

Replace <container_id_or_name> with the actual ID or name of your running container. The output should show the user and group as myuser and mygroup, respectively.

Conclusion

Congratulations! You’ve successfully set up a Docker container to run as a non-root user using BusyBox. This security-conscious approach enhances the overall robustness of your containerized applications.