If you have worked on container, then you can see that you need not provide user info while creating container. You may be wondering from where it is getting user info. This document helps in this.
A docker container by default runs as root user. This can be overridden by Dockerfile. A non root user can be created in Dockerfile. 'docker exec' command by default uses the user info mentioned in the Dockerfile, else it uses the root user.
A root user inside container is a root user in the host
Root inside container, root outside container
By default, a container runs as root user
# docker run -dt --name dktest ubuntu:14.04
a604604393a8ffecd8a7c322389cec009af0c73c217fe5064cd617107bccae57
# docker top dktest -> UID in host
UID PID PPID C STIME TTY TIME CMD
root 24376 24359 0 10:08 pts/0 00:00:00 /bin/bash
# docker exec -it dktest bash
root@a604604393a8:/# ps -auf -> UID in container
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 15 0.3 0.0 18184 3132 pts/1 Ss 04:38 0:00 bash
root 30 0.0 0.0 15576 2140 pts/1 R+ 04:38 0:00 \_ ps -auf
root 1 0.0 0.0 18180 3152 pts/0 Ss+ 04:38 0:00 /bin/bash
nonroot inside container, nonroot outside container
# docker run -dt --name dktest --user nobody --entrypoint /bin/bash ubuntu:14.04
6b3c58b37986beccbe7e85af8ff4068bdf344d755f3525869afcdbcce88cbaf1
# docker top dktest -> UID in host machine
UID PID PPID C STIME TTY TIME CMD
nobody 22118 22101 0 10:04 pts/0 00:00:00 /bin/bash
# docker exec -it dktest bash
nobody@6b3c58b37986:/$ ps -auf -> UID inside container
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
nobody 8 0.5 0.0 18168 3276 pts/1 Ss 04:35 0:00 bash
Remember that a process running in a container is no different from other process running on Linux, except it has a small piece of metadata that declares that it’s in a container. Containers are not trust boundaries, so therefore, anything running in a container should be treated with the same consideration as anything running on the host itself.
A container with root user can access host machine data which is not accessible in host by non-root
container accessing data owned by root user in host
root@ubuntu-232:~/deepak/cpxlicense# whoami
root
root@ubuntu-232:~/deepak/cpxlicense# echo "private key is mysecret" >>/root/topsecret.txt
root@ubuntu-232:~/deepak/cpxlicense# chmod 050 /root/topsecret.txt
root@ubuntu-232:~/deepak/cpxlicense# ls -ltrh /root/topsecret.txt
----r-x--- 1 root root 24 Feb 20 16:03 /root/topsecret.txt
root@ubuntu-232:~/deepak/cpxlicense# chmod 060 /root/topsecret.txt
root@ubuntu-232:~/deepak/cpxlicense# ls -ltrh /root/topsecret.txt
----rw---- 1 root root 24 Feb 20 16:03 /root/topsecret.txt
root@ubuntu-232:~/deepak/cpxlicense# su - nonroot
No directory, logging in with HOME=/
$ cat /root/topsecret.txt
cat: /root/topsecret.txt: Permission denied
$ sudo docker run -dt --name dktest --user nobody -v /root:/root ubuntu:14.04
77e7b0f3e454772195ee350949331fc8218558263960cba1fc65488bceb4cf9b
$ sudo docker exec -it dktest bash
nobody@77e7b0f3e454:/$ cat /root/topsecret.txt
cat: /root/topsecret.txt: Permission denied
$ sudo docker rm -f dktest
dktest
$ sudo docker run -dt --name dktest -v /root:/root ubuntu:14.04
cb29d7332ae2f5234cb04bd09b2e61371d6a67ba6d68d10c50a38ba4f13e7d20
$ sudo docker exec -it dktest bash
root@cb29d7332ae2:/# cat /root/topsecret.txt
private key is mysecret
root@cb29d7332ae2:/#
Text Box
# docker run -dt -P --name dktest -e EULA=yes --privileged=true --user nobody --entrypoint /bin/bash ubuntu:14.04
c4ce651258c68a427fa0652ae5a35ee3985102e815cd9f0197dc0a2d050c7e75
# docker exec -it --user nobody dktest /bin/bash
nobody@c4ce651258c6:/$ whoami
nobody
# cat /etc/passwd | egrep -i 'root|nobody'
root:x:0:0:root:/root:/bin/bash
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
# docker exec -it --user nobody2 dktest /bin/bash
unable to find user nobody2: no matching entries in passwd file
# docker exec -it --user root dktest /bin/bash
root@c4ce651258c6:/# whoami
root
There are CRIs, for example Podman CRI, which by default creates container which doesn't have root access outside container. This approach can mitigate the issue
https://www.redhat.com/en/blog/understanding-root-inside-and-outside-container
https://suraj.io/post/root-in-container-root-on-host/
https://stackoverflow.com/questions/35734474/connect-to-docker-container-as-user-other-than-root
https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
https://images.app.goo.gl/4KqwuAFTZLHt3YbPA
https://www.linkedin.com/posts/dpkumar_containersecurity-docker-containerhandling-activity-6776430212579237888-ijkQ