CODEWITHSUNDEEP
dockercontainersroot
Andy59469
Andy59469

Reputation: 2044

Connect to docker container as user other than root

BY default when you run

docker run -it [myimage]

OR

docker attach [mycontainer]

you connect to the terminal as root user, but I would like to connect as a different user. Is this possible?

Upvotes: 167

Views: 297153

Answers (9)

Jason
Jason

Reputation: 10842

You can run a shell in a running docker container using a command like:

docker exec -it --user $username <container_id_or_name> /bin/bash

Upvotes: 157

Nurhun
Nurhun

Reputation: 691

As an updated answer from 2020. --user, -u option is Username or UID (format: <name|uid>[:<group|gid>]).

Then, it works for me like this,

docker exec -it -u root:root container /bin/bash

Reference: https://docs.docker.com/engine/reference/commandline/exec/

Upvotes: 29

Josef S&#225;bl
Josef S&#225;bl

Reputation: 7732

This solved my use case that is: "Compile webpack stuff in nodejs container on Windows running Docker Desktop with WSL2 and have the built assets under your currently logged in user."

docker run -u 1000 -v "$PWD":/build -w /build node:10.23 /bin/sh -c 'npm install && npm run build'

Based on the answer by eigenfield. Thank you!

Also this material helped me understand what is going on.

Upvotes: 3

x-yuri
x-yuri

Reputation: 18823

For docker-compose. In the docker-compose.yml:

version: '3'
services:
    app:
        image: ...
        user: ${UID:-0}
...

In .env:

UID=1000

Upvotes: 1

daparic
daparic

Reputation: 4444

The only way I am able to make it work is by:

docker run -it -e USER=$USER -v /etc/passwd:/etc/passwd -v `pwd`:/siem mono bash
su - magnus

So I have to both specify $USER environment variable as well a point the /etc/passwd file. In this way, I can compile in /siem folder and retain ownership of files there not as root.

Upvotes: 2

Vasili Pascal
Vasili Pascal

Reputation: 3390

Execute command as www-data user: docker exec -t --user www-data container bash -c "ls -la"

Upvotes: 0

rmccabe3701
rmccabe3701

Reputation: 1468

My solution:

#!/bin/bash
user_cmds="$@"

GID=$(id -g $USER)
UID=$(id -u $USER)
RUN_SCRIPT=$(mktemp -p $(pwd))
(
cat << EOF
addgroup --gid $GID $USER
useradd --no-create-home --home /cmd --gid $GID --uid $UID  $USER
cd /cmd
runuser -l $USER -c "${user_cmds}"
EOF
) > $RUN_SCRIPT

trap "rm -rf $RUN_SCRIPT" EXIT

docker run -v $(pwd):/cmd --rm my-docker-image "bash /cmd/$(basename ${RUN_SCRIPT})"

This allows the user to run arbitrary commands using the tools provides by my-docker-image. Note how the user's current working directory is volume mounted to /cmd inside the container.

I am using this workflow to allow my dev-team to cross-compile C/C++ code for the arm64 target, whose bsp I maintain (the my-docker-image contains the cross-compiler, sysroot, make, cmake, etc). With this a user can simply do something like:

cd /path/to/target_software
cross_compile.sh "mkdir build; cd build; cmake ../; make"

Where cross_compile.sh is the script shown above. The addgroup/useradd machinery allows user-ownership of any files/directories created by the build.

While this works for us. It seems sort of hacky. I'm open to alternative implementations ...

Upvotes: 1

Larry Cai
Larry Cai

Reputation: 59933

For docker run:

Simply add the option --user <user> to change to another user when you start the docker container.

docker run -it --user nobody busybox

For docker attach or docker exec:

Since the command is used to attach/execute into the existing process, therefore it uses the current user there directly. 

docker run -it busybox  # CTRL-P/Q to quit
docker attach <container id>  # then you have root user
/ # id
uid=0(root) gid=0(root) groups=10(wheel)

docker run -it --user nobody busybox # CTRL-P/Q to quit
docker attach <container id>  
/ $ id
uid=99(nobody) gid=99(nogroup)

If you really want to attach to the user you want to have, then

  1. start with that user run --user <user> or mention it in your Dockerfile using USER
  2. change the user using `su

Upvotes: 166

kliew
kliew

Reputation: 3183

You can specify USER in the Dockerfile. All subsequent actions will be performed using that account. You can specify USER one line before the CMD or ENTRYPOINT if you only want to use that user when launching a container (and not when building the image). When you start a container from the resulting image, you will attach as the specified user.

Upvotes: 7

Related Questions