Privileged and Root User Access in Containers

One important way to improve the security of your containers is to reduce what an attacker can do if they manage to gain access. The types of command the attacker can run on the container are limited to the level of access the user who is running the processes on the container has. So, if there are no root or elevated privileges on the running container, this limits what the attacker can do. Another thing to remember is that if a container is compromised and is running as the root user, this may also allow the attacker to escape the container and access the host system running Docker.

Most processes running on the container are applications that don't need root access, and this is the same as running processes on a server, where you would not run them as root either. The applications running on the container should only have access to what they need. The reason why root access is provided, especially in base images, is because applications...