Understanding Docker's User Permissions

When working with Docker, one often encounters scenarios where it's desirable to copy files into a container as a non-root user. By default, Docker operates as the root user, and so does the COPY instruction in a Dockerfile. To enhance security and follow best practices, running applications as a non-root user is recommended, especially in production environments. In this article, we will delve into how you can COPY files into your Docker container as a non-root user and explore related concepts.

Basics of Docker COPY

The COPY instruction serves as a fundamental component of Dockerfile syntax, allowing you to copy files or directories from your build context to the image being created.

Syntax

COPY <source_path> <destination_path>

The Idiosyncrasies of Permissions

When executing Docker commands as a non-root user, one must first understand how Linux permissions work at the filesystem level. Docker derives its behavior from these Linux permissions.

• User (u): The owner of the file.
• Group (g): A set of users who are assigned certain permissions as a group.
• Others (o): Users who are neither the owner nor part of the group.

Managing permissions is crucial because Docker containers can carry these permissions over when files are copied into them. By default, Docker's operations will use the root user's permissions, resulting in any copied files being owned by root.

Implementing Non-root File Copy

Step 1: Create a Non-root User in Your Dockerfile

First, you need to create a new user and switch to that user before executing the COPY command. This involves the creation of the user and group, assigning the right permissions, and then switching to the new user context.

1# Use an appropriate base image
2FROM ubuntu:20.04 
3
4# Create a new user and group
5RUN groupadd -r myuser && useradd --no-log-init -r -g myuser myuser
6
7# Create a working directory and assign ownership to the new user
8RUN mkdir /app && chown myuser:myuser /app
9
10# Switch to the new user
11USER myuser
12
13# Copy files using the new user's context
14COPY --chown=myuser:myuser . /app

Explanation

1. groupadd -r and useradd --no-log-init: Add a new user and group without home directory or interactive shell (non-login user).
2. chown: Change the ownership of the /app directory to the specified user and group.
3. USER myuser: Switches the active user to myuser.
4. COPY --chown: Copies files from the context to the container with ownership set to myuser:myuser.

Step 2: Leveraging Permissions

Learn to modify file permissions such that the necessary files are accessible to the non-root user. For instance, files that will be written by the container process should be writable by a non-root user.

# Set file permissions
RUN chmod 755 /app

Validating Permissions

After setting up your Dockerfile, you must validate the permissions during the build or runtime. This can be done through:

docker exec -it <container-id> bash -c "ls -l /app"

This command will display the ownership and permissions of the files, helping you check if everything is aligned with your expectations.

A Table Summary

Conclusion

Copying files as a non-root user in Docker offers enhanced security and aligns with best practices. It involves crafting Dockerfiles strategically to adjust permissions, create and switch user contexts, and validate setups. By paying attention to these elements, your Docker containers can run efficiently and securely as non-root users, reducing potential attack vectors and adhering to container security policies.