How to run a Docker container as a non-root user

Container runs as a non-root user · docker.nonroot

Why it matters

A process running as root inside the container is root on the host the moment it escapes — through a kernel bug, a mounted socket or a misconfigured volume. A USER line costs nothing.

How to fix it

What to do: Add a non-root user to your Dockerfile before CMD.

# Add these lines BEFORE CMD/ENTRYPOINT:
RUN useradd --create-home --shell /bin/sh --uid 1001 appuser \
    && chown -R appuser:appuser /app
USER appuser

# Verify: user should not be root
# docker run --rm myimage id
# → uid=1001(appuser) gid=1001(appuser)

Does your repository pass this check?

Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.

Related checks