Post History

UID of nonroot user in distroless container images

Distroless images use a user called `nonroot` by convention. What's the UID (User ID) of this user?

This is relevant in multi-stage image builds:

```containerfile
FROM bash:latest as builder

RUN adduser adduser \
  --disabled-password \
  --gecos "" \
  --home "/nonexistent" \
  --shell "/sbin/nologin" \
  --no-create-home \
  --uid "???" \
  "nonroot"
USER nonroot

WORKDIR /app

# Simulating a build here
RUN echo binary > executable


# A distroless base image for static executables.
# It uses the nonroot user:
# https://edu.chainguard.dev/chainguard/chainguard-images/reference/glibc-dynamic/image_specs/
FROM cgr.dev/chainguard/cc-dynamic:latest

WORKDIR /app

COPY --from builder /app/executable ./

CMD "/app/executable"
```

The UIDs need to match in the builder stage and the final image.