Why Docker Containers Run as Root

Docker containers run as the root user by default. On a regular server, the rule is "use a normal user day-to-day, escalate with sudo only when needed", but in containers, root is the standard. Containers do run in an environment that is largely isolated from the host OS. However, they are not completely independent: depending on configuration and circumstances, a container can still affect the host.

For this reason, modern best practices are moving toward running containers as a non-root user. You add a USER instruction in your Dockerfile to run the application as a dedicated user. It's a defense-in-depth approach, an extra layer of protection against potential vulnerabilities.

User and group concepts apply beyond server administration; they're used in the container world too. RUN useradd creates a user in a Dockerfile, and USER switches to it, the very same commands you use in the terminal.