Linux Labs
Linux Labs
EN

Containers: Docker and compose / Stage 10 of 11

Limits, OOMKilled and the user in a container

Not running Starting usually ~20 s
Leave the lesson

Step 6 of 9 · theory · 3 min

The --user option

The main process's user is set by the --user option when the container is created; docker exec runs as the same user by default.

docker looks up the name after --user in the image's /etc/passwd, and alpine has no student user. Numbers always work: --user 1000:1000 is student's UID and GID, though id inside prints them without names.

bash 
sudo docker run --rm --user student alpine id
# … unable to find user student: no matching entries in passwd file
sudo docker run --rm --user 1000:1000 alpine id
# uid=1000 gid=1000 groups=1000

The number after the colon is the group. Without it, the process gets group 0, which is the root group.

Check yourself 1 question

A container started with --user 1000 created a file in a directory on the machine. Who will ls -l show as the owner and group of that file?

  • The file's owner comes from the process UID, which is 1000 — that is student. root remains only in the group.

  • The group is set by the number after the colon in --user. Without it, the process runs with GID 0, and the file gets the root group.

Without a GID after the colon, the process runs with group 0. The file gets the owner student and the group root, which is why --user is written as a pair: 1000:1000.

Key points

  • A process's UID in a container is the same UID on the machine: root inside is root for the host files mounted in.
  • --user UID:GID sets the main process's user; docker exec runs as the same user.
  • A name in --user is looked up in the image, numbers always work; without a GID the process group is root.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…