Re:Calibre 5.0
by kubav on Friday September 25, 2020 @03:33AM
(#24587479)
It is easier for developer but risky for end user. Docker runs as root and you have to trust application developer to use latest security patches for all dependencies.
[ Parent
| on HN ]
They run as root per default.
Simply using the "USER <uid/uname>" directory means you run as non-root user with a specified UID. Kubernetes recommends doing that as a baseline security measure. You can also drop caps from a container so even if you are root inside, you can't do a lot of things root can.