How do I run my Go application in the scratch container as the user "nobody?"

Question

I don't want to run anything in a docker container as root. And I want minimalistic images.

I can run my compiled Go app in the scratch-image without a problem. But when I don't want it to run as root (i assume its running as root) and define USER nobody in the dockerfile I get

014/10/25 06:07:10 Error response from daemon: Cannot start container 
4822f34e54e20bb580f8cd1d38d7be3c828f28595c2bebad6d827a17b4c2fe21: 
finalize namespace setup user get supplementary groups Unable to find user nobody

here is my dockerfile

FROM scratch
ADD lichtpunkt_go_linux_amd64 /lichtpunkt_go_linux_amd64
ADD web /web
USER nobody
CMD ["./lichtpunkt_go_linux_amd64"]
EXPOSE 3001

EDIT ------------

turns out that scratch is empty, very empty.

RUN useradd would execute /bin/sh -c useradd but there is no /bin/sh . RUN ["useradd"] would exec directly. but there is no useradd. i d have to add rootfs.tar and build stuff from zero.

i ll use debian as i don't wont to run anything as root within a container because ...

Treat root within a container as if it is root outside of the container

Use `COPY` instead of `ADD`. It is official recommendation. – Константин Ван May 26 '21 at 05:12 — Константин Ван, May 26 '21 at 05:12

score 10 · Answer 1 · edited Dec 23 '18 at 12:47

10

The solution is to use multi-stage build and copy /etc/passwd, as explained in this nice blog-post by Liz Rice.

edited Dec 23 '18 at 12:47

brasofilo

25,496
15
91
179

answered Dec 23 '18 at 12:03

Idan

229
2
8

1

Maybe people mistakenly voted this as "link-only" answer, but that's not the case. Idan, I made an edit to put the solution first so there's little room for doubt.. – brasofilo Dec 23 '18 at 12:48

Константин Ван · Answer 2 · 2022-03-07T09:39:59.197

5

Create a file with the following content and COPY it into the scratch container as /etc/passwd.

nobody:*:65534:65534:nobody:/_nonexistent:/bin/false

You can COPY /bin/false as well; or you don’t, in which case, attempts to log in as nobody will simply just fail.

su: failed to execute /bin/false: No such file or directory

edited Mar 07 '22 at 09:39

answered May 26 '21 at 11:29

Константин Ван

12,550
7
61
73

score 2 · Answer 3 · edited May 26 '21 at 07:23

2

Before the USER command, add this line: ADD passwd.minimal /etc/passwd

With the following line in the file passwd.minimal: nobody:x:65534:65534:Nobody:/:

edited May 26 '21 at 07:23

Константин Ван

12,550
7
61
73

answered Nov 24 '14 at 20:44

mlnoga

29
2

2

Use `COPY` instead of `ADD`. It is official recommendation. – Константин Ван May 26 '21 at 05:13
The `passwd` record is **not secure.** Its `home-dir` field is the root directory, and `login-shell` field is empty, which defaults to `/usr/bin/sh` (if exists in the `scratch` container). – Константин Ван May 26 '21 at 10:22

score -1 · Accepted Answer · answered Oct 26 '14 at 17:47

turns out that scratch is empty, very empty.

RUN useradd would execute /bin/sh -c useradd but there is no /bin/sh . RUN ["useradd"] would exec directly. but there is no useradd. i d have to add rootfs.tar and build stuff from zero.

i ll use debian as i don't wont to run anything as root within a container because ...

Treat root within a container as if it is root outside of the container

http://opensource.com/business/14/7/docker-security-selinux

**Accept what answers the question, not what you ended up doing.** — Константин Ван, May 26 '21 at 05:21

score -3 · Answer 5 · answered Oct 26 '14 at 14:51

-3

You still have to add the user before you can use it with the USER command.

FROM scratch
ADD lichtpunkt_go_linux_amd64 /lichtpunkt_go_linux_amd64
ADD web /web
RUN useradd nobody
USER nobody
CMD ["./lichtpunkt_go_linux_amd64"]
EXPOSE 3001

answered Oct 26 '14 at 14:51

Usman Ismail

17,999
14
83
165

turns out that scratch is empty. RUN useradd would execute /bin/sh -c. but there is no /bin/sh . RUN ["useradd"] would exec directly. but there is no useradd. i d have to add rootfs.tar and build stuff from zero. i ll use debian. thx – somedude Oct 26 '14 at 17:42

How do I run my Go application in the scratch container as the user "nobody?"

5 Answers5