Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
UID of nonroot user in distroless container images
+0
−0
Distroless images use a user called nonroot by convention. What's the UID (User ID) of this user?
This is relevant in multi-stage image builds:
FROM bash:latest as builder
RUN adduser adduser \
--disabled-password \
--gecos "" \
--home "/nonexistent" \
--shell "/sbin/nologin" \
--no-create-home \
--uid "???" \
"nonroot"
USER nonroot
WORKDIR /app
# Simulating a build here
RUN echo binary > executable
# A distroless base image for static executables.
# It uses the nonroot user:
# https://edu.chainguard.dev/chainguard/chainguard-images/reference/glibc-dynamic/image_specs/
FROM cgr.dev/chainguard/cc-dynamic:latest
WORKDIR /app
COPY --from builder /app/executable ./
CMD "/app/executable"
The UIDs need to match in the builder stage and the final image.
2 answers
+0
−0
You don't actually need the UID in that particular example.
A more elegant solution would be to use the --chown option of the COPY directive.
FROM bash:latest as builder
RUN adduser adduser \
--disabled-password \
--gecos "" \
--home "/nonexistent" \
--shell "/sbin/nologin" \
--no-create-home \
"nonroot"
USER nonroot
WORKDIR /app
# Simulating a build here
RUN echo binary > executable
# A distroless base image for static executables.
# It uses the nonroot user:
# https://edu.chainguard.dev/chainguard/chainguard-images/reference/glibc-dynamic/image_specs/
FROM cgr.dev/chainguard/cc-dynamic:latest
WORKDIR /app
# This eliminates the need for UIDs.
COPY --from builder --chown=nonroot /app/executable ./
CMD "/app/executable"
0 comment threads
0 comment threads