Run containers as a non-root user with USER

If a service can run without privileges, use the USER instruction to change to a non-root user, creating the user and group in the Dockerfile first, for example RUN groupadd -r postgres && useradd --no-log-init -r -g postgres postgres. Assign an explicit UID/GID when it's critical, because users and groups in an image are assigned a non-deterministic UID/GID — the next value is assigned regardless of image rebuilds. Avoid installing or using sudo, since it has unpredictable TTY and signal-forwarding behavior; if you absolutely need similar functionality, such as initializing the daemon as root but running it as non-root, consider gosu. To reduce layers and complexity, avoid switching USER back and forth frequently. Koskamo editorial guidance: run production containers as non-root by default — a compromised or misbehaving process then holds only the container user's privileges rather than root, which shrinks the blast radius of a container breakout or remote code execution. Scope: Dockerfile USER instruction. Reviewed October 4, 2026.