For example, look at SSL/TLS certificates - before Let's Encrypt ( https://letsencrypt.org/ ) and tools like either Certbot ( https://certbot.eff.org/ ) or even web servers like Caddy ( https://caddyserver.com/ ) which automate both provisioning and renewing certificates, people used to simply run HTTP. But now, it's easier than ever to use them for transport level security, and the stats seem to vaguely back this up, for example: https://www.welivesecurity.com/2018/09/03/majority-worlds-to...
Why should users inside of containers be any different? What are the factors that prevent safe defaults from being implemented? That's what i don't understand.
Disclaimer: i'm not advocating for running things as root, but rather my claim is that if things are hard to do, they simply won't be done unless absolutely necessary. Any tech vendor should acknowledge this and make sure that doing things the "right way" is as easy as possible.
The issue is complexity and lack of appropriate abstractions.
The "Let's Encrypt" of dockerfile safety would be something that makes it trivial to 1) create a user 2) chmod/chown an appropriate spot on the fs, 3) ideally let the author defer these actions to always finalize the image in user mode. That way, you declare at the top that you will do these user actions, but RUN stays as root. Or just provide an SRUN, SCOPY,SADD directive which acts like running with sudo. Then, you can easily extend a layer or base image without being concerned with the details of how user space is implemented.
Also there is no standard or idiomatic protocol for setting up user space in a dockerfile.
You either specify the user when creating the container (which can have certain implications, like being able to bind to < port 1024... solveable but still something to deal with) or you can for everything to run with a uid mapping such that uids in the container are mapped to higher uids on the host.
Also, all the sentences that begin with '>' were comments from https://github.com/caddyserver/caddy-docker/issues/104, and not from the user gbrindisi
If the official Docker image did that, then most users would be very confused and we would get lots of support complaints. A cost-benefit analysis told us it was not worth the headache to run as non-root since the Caddy project values highly user experience.
But the argument is, should it be a bad practice?
Are you really asking if running external-facing services as root should be considered a bad practice?
That does not sound like an adequate excuse, does it?
I'm afraid none of your remarks makes a reasonable point. Even if you believe that running random stuff as root is ok, if you do not have any reason to do that then why should we mindlessly follow bad practices? If we aim at running a safe system.and there is absolutely zero drawback in following best practices, then why should we continue to make the mistake of intentionally using poor practices?