Developer tools · Docker run to Docker compose converter
Running containers as root: what --user and user: change and why
· Why it matters
docker containers security
Unless the image says otherwise, the process in your container is root. This post explains what that means on the host, how --user and the Compose user: key change it, and the file-ownership problems that follow.
Files you cannot delete — a bind mount is full of root-owned files after one container run
Files you cannot delete — a bind mount is full of root-owned files after one container run. Evidence: bind-mounted output can expose identity mismatches parsing cannot diagnose. Reproduce runtime identity with disposable literals. Pair each source occurrence with user mounts capabilities; reserve namespaces and ownership for destination review.
The security incident also reveals that A separate security incident boundary is that image USER and entrypoint switches require inspect or image sources. Evidence: image USER and entrypoint switches require inspect or image sources. This runtime identity constraint is a stopping point. Inspect user mounts capabilities without manufacturing behavior, then document a host check for namespaces and ownership.
Root inside is root outside — with default user namespace settings, UID 0 in the container is UID 0 on the host for mounted files
Root inside is root outside — with default user namespace settings, UID 0 in the container is UID 0 on the host for mounted files. Evidence: UID zero host effects depend on namespace configuration not read here. Trace runtime identity tokens into user mounts capabilities. Separate ordered values from last-value fields; namespaces and ownership is outside collection.
A related security mechanism boundary is that A separate security grammar boundary is that a 1000:1000 example demonstrates preservation not ownership guarantees. Evidence: a 1000:1000 example demonstrates preservation not ownership guarantees. Use this runtime identity fact to predict one member or scalar in user mounts capabilities. Check warnings before deciding anything about namespaces and ownership.
--user becomes user: — numeric UID:GID versus names, and why numeric is safer when the image has no matching account
--user becomes user: — numeric UID:GID versus names, and why numeric is safer when the image has no matching account. Evidence: --user becomes user and numeric UID:GID text is quoted. Judge runtime identity serialization from its model. Quoting in user mounts capabilities protects types but gives no operational proof for namespaces and ownership.
The second security serialization observation is A separate security output boundary is that read_only cap_drop and security_opt map while rootless mode does not. Evidence: read_only cap_drop and security_opt map while rootless mode does not. This runtime identity output separates settings from unavailable context. Keep user mounts capabilities reviewable and check namespaces and ownership independently.
Images that already drop privileges — USER in the Dockerfile, and images that switch users in their entrypoint
Images that already drop privileges — USER in the Dockerfile, and images that switch users in their entrypoint. Stop at the runtime identity exception instead of guessing. Any addition near user mounts capabilities needs a deployment-specific reason tied to namespaces and ownership.
Another security exception constraint is that A separate security exception boundary is that namespace remapping and Kubernetes contexts are out of scope. Evidence: namespace remapping and Kubernetes contexts are out of scope. Keep the original runtime identity command beside warnings. The comparison shows what user mounts capabilities contains and which namespaces and ownership decision remains manual.
Worked example: converting docker run --user 1000:1000 -v /srv/app:/app — the user: key and the resulting ownership on disk
Worked example: converting docker run --user 1000:1000 -v /srv/app:/app — the user: key and the resulting ownership on disk. Build the runtime identity example from synthetic names. Make every user mounts capabilities item traceable without exposing production namespaces and ownership details.
The same security example sample demonstrates that A separate security example boundary is that identity becomes visible beside mounts and capabilities for review. Evidence: identity becomes visible beside mounts and capabilities for review. The paired runtime identity fact should be visible in user mounts capabilities. Record that line and avoid assumptions about namespaces and ownership.
Other hardening keys — read_only, cap_drop: [ALL], security_opt no-new-privileges, and rootless Docker as the bigger step
Other hardening keys — read_only, cap_drop: [ALL], security_opt no-new-privileges, and rootless Docker as the bigger step. Translate the runtime identity consequence into one observable user mounts capabilities difference. Docker owns the later namespaces and ownership verdict.
The security consequence implementation also shows A separate security effect boundary is that bind-mounted output can expose identity mismatches parsing cannot diagnose. Split runtime identity responsibilities: conversion writes user mounts capabilities, the repository removes secrets, and operators validate namespaces and ownership.
What this does not cover — user namespace remapping configuration and Kubernetes securityContext
What this does not cover — user namespace remapping configuration and Kubernetes securityContext. Limit runtime identity scope to user mounts capabilities branches shown here. Neighboring forms and defaults cannot answer namespaces and ownership questions.
One more security scope limit follows from A separate security limit boundary is that UID zero host effects depend on namespace configuration not read here. Treat this runtime identity boundary as an exclusion. Prefer accurate user mounts capabilities over guesses about namespaces and ownership.
Takeaway: decide who your process is — and check the converter's output includes user: before you bring the stack up
Takeaway: decide who your process is — and check the converter's output includes user: before you bring the stack up. Audit runtime identity as source option, model field, user mounts capabilities line and warning. Remove secrets before checking namespaces and ownership.
Finally, the security takeaway source confirms A separate security decision boundary is that --user becomes user and numeric UID:GID text is quoted. Close runtime identity narrowly: user mounts capabilities is a candidate; namespaces and ownership and shell equivalence are not guarantees.