Details

https://github.com/docker/docker/issues/7906

Solution

Ensure that the Dockerfile for the container image contains below instruction-USER
where username or ID refers to the user that could be found in the container base image. If
there is no specific user created in the container base image, then add a useradd command
to add the specific user before USER instruction.For example, add the below lines in the Dockerfile to create a user in the container-RUN useradd -d /home/username -m -s /bin/bash username
USER usernameWhen you run the container, use the ‘-u’ flag to specify that you would want to run the
container as a specific user and not root. This can be done by executing below command-$> docker run -u
For example,$> docker run -u 1000 -i -t centos /bin/bashThis would ensure that the above container is run with user ID 1000 and not root.Note- If there are users in the image that the containers do not need, consider deleting
them. After deleting those users, commit the image and then generate new instances of
containers for use.

Impact-None.

Default Value-By default, the containers are run with root privileges and as user root inside the
container.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/514https://workbench.cisecurity.org/files/514

This control applies to the following type of system Unix.

Source

• Tenable.com/audits