Re:Inside Docker's “FROM scratch”
by embano1 on Monday November 27, 2017 @07:03AM
(#15786684)
Yup, in the end it´s an OS process and all rules apply. I did not care too much about Dockerfile best practices in my article. Good point, should at least have used "user <!root>".
https://docs.docker.com/engine/reference/builder/#user
You can use `setcap` to grant capabilities to the binary or the `pam_cap` module if you need to do capabilities per user.
I haven't run across the need to run most containers as root for a while now.