Docker Community Forums

Share and learn in the Docker community.

Root user when service already has a dedicated user

I’m using this image GitHub - Unicon/shibboleth-sp-dockerized: A Shibboleth Service Provider (SP) base-image which has Apache and Shibboleth (a SAML authentication module for Apache)

The container runs as root to start the two services an each service has it’s own user httpd and shibd.

If I do a ps -aux inside the container this can be confirmed.

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  1.4  0.8 277108 18308 ?        Ss   12:02   0:00 httpd -DFOREGROUND
shibd       25  0.5  1.2 512608 24964 ?        Ssl  12:02   0:00 /usr/sbin/shibd -p /var/run/shibboleth/shibd.pid -f -w 30
apache      32  0.5  0.8 428332 16872 ?        Sl   12:02   0:00 httpd -DFOREGROUND
apache      33  0.4  0.8 428332 16872 ?        Sl   12:02   0:00 httpd -DFOREGROUND
apache      35  0.4  0.8 428332 16872 ?        Sl   12:02   0:00 httpd -DFOREGROUND
apache      36  0.5  0.8 428332 16872 ?        Sl   12:02   0:00 httpd -DFOREGROUND
apache      37  0.5  0.8 428332 16872 ?        Sl   12:02   0:00 httpd -DFOREGROUND

I need to dynamically modify configuration files per environment at runtime so the start of services is the last command in a bash script.

Now the question… I always run containers without ROOT as the last user. In this case I don’t see an easy way of doing that, specially as Shibboleth runs as a daemon an a regular user can’t do that.

Is that approach secure? each service runs with a non-root user but the container entry point is not.