VS Code devcontainers - what is the difference between remoteUser and containerUser?

Question

Reading the devcontainer.json reference, I still can't understand: https://code.visualstudio.com/docs/remote/devcontainerjson-reference

containerUser: Overrides the user all operations run as inside the container.
remoteUser: Overrides the user that VS Code runs as in the container (along with sub-processes like terminals, tasks, or debugging)

What is the difference between containerUser and remoteUser? When should I use one or the other? Can you provide examples?

Thanks!

Answer 1

From the definition of the devcontainer.json schema

{
    "remoteUser": {
        "type": "string",
        "description": "The username to use for spawning processes in the container including lifecycle scripts and any remote editor/IDE server process. The default is the same user as the container."
    },
    "containerUser": {
        "type": "string",
        "description": "The user the container will be started with. The default is the user on the Docker image."
    }
}

Microsoft has a good explanation of the difference here. To summarize:

• Use remoteUser if you want your IDE and its subprocesses (terminal, tasks, debugging) to run as a specific user

• If you need the entire container, including all processes, to run as a specific user, use containerUser