Use numeric UID in Dockerfiles for better container security#1624
Conversation
Kubernetes runAsNonRoot and other container runtimes may require numeric UIDs. Switch USER directives to UID 1001 across all Dockerfiles. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates container user configuration to use a fixed numeric UID (1001) so images are compatible with Kubernetes runAsNonRoot and similar runtime policies.
Changes:
- Switch
USERdirectives to numeric UID1001. - Pin created
appuserUID/GID to1001in Debian-based images.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
autoadmin-ws-server/Dockerfile |
Runs the service as numeric UID 1001 (instead of named user). |
Dockerfile.rocketadmin-agent |
Pins appuser to UID/GID 1001 and runs as UID 1001. |
Dockerfile |
Pins appuser to UID/GID 1001 and runs as UID 1001. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| COPY --from=builder /app/dist ./dist | ||
|
|
||
| USER nodejs | ||
| USER 1001 |
There was a problem hiding this comment.
Using USER 1001 sets only the UID; depending on the container runtime, the GID may default to 0 (root) when the group isn’t specified. To keep the process out of the root group and match the created nodejs group (GID 1001), set the directive explicitly to USER 1001:1001 (or USER nodejs:nodejs).
| USER 1001 | |
| USER nodejs:nodejs |
| RUN chown -R appuser:appuser /app | ||
|
|
||
| USER appuser | ||
| USER 1001 |
There was a problem hiding this comment.
USER 1001 sets only the UID; some runtimes may default the primary GID to 0 (root) if it isn’t specified. Since you’re creating appuser with GID 1001, use USER 1001:1001 to ensure the container doesn’t run in the root group and to avoid group-based permission surprises.
| USER 1001 | |
| USER 1001:1001 |
| RUN chown -R appuser:appuser /run | ||
|
|
||
| USER appuser | ||
| USER 1001 |
There was a problem hiding this comment.
USER 1001 sets only the UID; the effective GID can default to 0 (root) when the group isn’t provided, which is a security footgun and can cause unexpected permission behavior. Since appuser is created with GID 1001, prefer USER 1001:1001 here.
| USER 1001 | |
| USER 1001:1001 |
Kubernetes runAsNonRoot and other container runtimes may require numeric UIDs. Switch USER directives to UID 1001 across all Dockerfiles.