Privileges in an Ubuntu Docker container after USER statement in Dockerfile

Question

I created a Dockerfile

FROM       ubuntu:latest

as the parent image.

Later the Dockerfile creates a new group and user without sudo privileges via

RUN groupadd -r myappuser -g 433
RUN useradd -u 431 -r -g myappuser -d /opt/myapp -s /bin/false -c "my app user" myappuser

Before executing the application I switch to this new

USER       myappuser

Question: Does this setting make it possible to gain root privileges again once the image is build and the container is running (with e.g. docker exec -it)?

just a though, can you add the user to sudoers or is that not what you are looking for? — Greg
– Greg, Commented Feb 20, 2015 at 13:53
Since this user is dedicated for running the main application it should not have full privileges .. — Jens Piegsa
– Jens Piegsa, Commented Feb 20, 2015 at 16:20

csanchez · Accepted Answer · 2015-02-20 19:55:58Z

3

If you don't want to use sudo, you could have a Dockerfile without USER (so it runs the command as root) and CMD pointing to a script that does the user switching, that way a docker exec would run as root.

Other way is to set the root password and use su. An example of doing that is in the tutum images

https://github.com/tutumcloud/tutum-centos/blob/master/set_root_pw.sh

answered Feb 20, 2015 at 19:55

csanchez

1,65912 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Privileges in an Ubuntu Docker container after USER statement in Dockerfile

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related