DEV Community

Robin Moffatt
Robin Moffatt

Posted on • Originally published at rmoff.net on

Running as root on Docker images that don't use root

#docker #root #sudo

tl;dr: specify the --user root argument:

docker exec --interactive \
            --tty \
            --user root \
            --workdir / \
            container-name bash
Enter fullscreen mode Exit fullscreen mode

There are good reasons why running in a container as root is not a good idea, and that’s why many images published nowadays avoid doing this. Confluent Platform’s Docker images changed to using appuser with the 6.0 release.

Checking the container user

You can check what user your container is running with:

$ docker exec --interactive --tty kafka bash
[appuser@b59043522a44 ~]$ whoami
appuser
Enter fullscreen mode Exit fullscreen mode

or more directly:

$ docker exec --interactive --tty kafka whoami
appuser
Enter fullscreen mode Exit fullscreen mode

Changing the container user

Using the --user root argument when launching the Docker exec command you can override the container’s user:

$ docker exec --interactive --tty --user root kafka bash
[root@b59043522a44 appuser]# whoami
root
Enter fullscreen mode Exit fullscreen mode

or

$ docker exec --interactive --tty --user root kafka whoami
root
Enter fullscreen mode Exit fullscreen mode

What, no sudo?

Imagine this nightmare scenario 🙀 :

$ docker exec --interactive --tty kafka bash
[appuser@b59043522a44 ~]$ yum install jq
Error: This command has to be run under the root user.
[appuser@b59043522a44 ~]$ sudo yum install jq
bash: sudo: command not found
[appuser@b59043522a44 ~]$
Enter fullscreen mode Exit fullscreen mode

Now, installing into Docker containers is not The Right Way - you should amend the Docker image to install what’s needed before invocation as a container. BUT sometimes needs must. Whether a quick hack, or just a PoC that you want to get running - sometimes you do want to install into a container, and that can be more difficult without root.

You can use the same approach as above (--user root):

$ docker exec --interactive --tty --user root kafka bash
[root@b59043522a44 appuser]# yum install -y jq
Confluent repository 13 kB/s | 29 kB 00:02
Red Hat Universal Base Image 8 (RPMs) - BaseOS 978 kB/s | 772 kB 00:00
Red Hat Universal Base Image 8 (RPMs) - AppStream 1.8 MB/s | 4.9 MB 00:02
Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder 40 kB/s | 13 kB 00:00
zulu-openjdk - Azul Systems Inc., Zulu packages 95 kB/s | 123 kB 00:01
[…]
]
Installed:
  jq-1.5-12.el8.x86_64 oniguruma-6.8.2-2.el8.x86_64

Complete!
Enter fullscreen mode Exit fullscreen mode

Logging in as root on Oracle’s Database Docker Image

Using Oracle’s Docker database image I wanted to install some additional apps, without modifying the Dockerfile.

Connect to the container:

$ docker exec --interactive --tty docker-compose_oracle_1_479e7fa05ab5 bash
Enter fullscreen mode Exit fullscreen mode

No sudo:

[oracle@a37d6e99353b ~]$ sudo whoami
bash: sudo: command not found
Enter fullscreen mode Exit fullscreen mode

Googled, found the the --user flag for Docker, tried that:

$ docker exec --interactive --tty --user root docker-compose_oracle_1_479e7fa05ab5 bash
OCI runtime exec failed: exec failed: container_linux.go:348: starting container process caused "chdir to cwd (\"/home/oracle\") set in config.json failed: permission denied": unknown
Enter fullscreen mode Exit fullscreen mode

Evidently, the Docker image tries to change directory to the Oracle home folder which Docker’s not happy doing as another user (even though it’s root?).

Googled some more, found the --workdir flag to override the WORKDIR setting of the Dockerfile from which the image is built:

$ docker exec --interactive --tty --user root --workdir / docker-compose_oracle_1_479e7fa05ab5 bash
bash-4.2# whoami
root
Enter fullscreen mode Exit fullscreen mode

Top comments (0)

Read next

marcuskohlberg profile image

How to deploy a backend application to DigitalOcean using Docker and Encore

Marcus Kohlberg -

bad-logic profile image

Introduction to SSH setup

Roshan Bhattarai -

welel profile image

Wait for Services to Start in Docker Compose: wait-for-it vs Healthcheck

Pavel Loginov -

code42cate profile image

How to Dockerize and Deploy Astro

Jonas Scholz -