docker-images/nodejs
docker-images/nodejs
1
0
Fork 0
mirror of https://github.com/nodejs/docker-node.git synced 2025-04-18 17:04:01 +03:00
Code

docs: Use numeric uid instead of username in Dockerfile

Browse Source 
Systems configured to disallow running images as root aren't able to run images that use user name string values for the `USER` because they can't validate that a named user isn't root. To allow images to run on such systems, use the uid of the user as the value for `USER` instead of the username.

See: https://github.com/kubernetes/kubernetes/pull/56503
This commit is contained in:
Craig Andrews 2025-01-16 12:23:37 -05:00 committed by GitHub
parent 6502c3ec72
commit 655ca3407c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/BestPractices.md
View File

@ -98,7 +98,7 @@ You can also include Tini [directly in your Dockerfile](https://github.com/krall
## Non-root User
By default, Docker runs commands inside the container as root which violates the [Principle of Least Privilege (PoLP)](https://en.wikipedia.org/wiki/Principle_of_least_privilege) when superuser permissions are not strictly required. You want to run the container as an unprivileged user whenever possible. The node images provide the `node` user for such purpose. The Docker Image can then be run with the `node` user in the following way:
By default, Docker runs commands inside the container as root which violates the [Principle of Least Privilege (PoLP)](https://en.wikipedia.org/wiki/Principle_of_least_privilege) when superuser permissions are not strictly required. You want to run the container as an unprivileged user whenever possible. The node images provide the `node` user with uid 1000 for such purpose. The Docker Image can then be run with the `node` user in the following way:
```
-u "node"
@ -110,7 +110,7 @@ Alternatively, the user can be activated in the `Dockerfile`:
FROM node:6.10.3
...
# At the end, set the user to use when running this image
USER node
USER 1000 # node
```
Note that the `node` user is neither a build-time nor a run-time dependency and it can be removed or altered, as long as the functionality of the application you want to add to the container does not depend on it.