[D01] Issues with relying on (or advertising) Docker instruction `USER`

[hartwork]

The current text mentions:

Then, before you start the microservice, the USER <username> [3] switches to this user.

While that is true and might be of help while building an image, it is my understanding that it would be a mistake to let the image tell the operator what user to use unless we have full control over the the image we run. E.g. you could drop line USER node from Dockerfile and when I rebuild or pull the image again next time, I'd start running the image as user root. (If I had a line in docker-compose.yml or my Docker command line running the image, I would be safe against that kind of change.)

What do you think?

[hartwork]

Any thoughts?

[drwetter]

This is a different scenario. It describes a threat not from a user but from the application running under elevated privileges.

[hartwork]

@drwetter the section "How Do I prevent?" is about preventing root permissions inside the container and the USER command is no protection against that as long as the image is controlled by another party and not fully pinned. Please help me understand your comment and how the current text does not promote a false sense of security. Thank you! 🙏

[drwetter]

You need to read the first sentence: The threat is here that a microservice is being offered to run under root in the container

[hartwork]

@drwetter I don't understand your point. How is that different from what I said? Why is the USER command one of two choices listed under "how to prevent" when it's not preventing it in a waterproof way?