Run docker as root verus non-root

Question

Get confusing about "run docker as non-root vs root user".

First question (run as non-root user): based on Post-installation steps for Linux, to run docker as non-root, we create the docker group and add the user to it. Yet the article claims "The docker group grants privileges equivalent to the root user". So if I understand this sentence correctly, we don't run the docker as root, but we run it as a user(in docker group) who is as powerful as root?

Second question (run as root user): assume I followed the steps above (create docker group and add user to it). Yet I specify "USER root" in a Dockerfile (example below). When I run this container, it will run as root regardless of the setting above, correct?

FROM debian:stretch
USER root
CMD["echo", "hello"] 

Answer 1

The docker group grants privileges equivalent to the root user

By default yes. This is also true for any user that can run a docker container on the machine.

The reason is that by default when you are running as root inside the container, this will map to root on the host machine. Thus you can bind some sensitive folders from the host onto the container, and execute privileged actions on those mounts since the user inside the container is root (pid 0).

The solution for that is to enable the user-namespace that basically would map the root user inside the container into a non-root user on the machine.

Second question (run as root user): assume I followed the steps above (create docker group and add user to it). Yet I specify "USER root" in a Dockerfile (example below). When I run this container, it will run as root regardless of the setting above, correct?

There are several points here:

• By default, USER root is the default, so you don't have to specify it. (Unless the base image explicitly sets a user other than root)
• From the perspective of the host machine, a docker container is just a normal process. Every process has an owner. This owner is the host machine user that executed the docker runcommand. The USER root instruction has nothing to do with this owner. The USER instruction only specifies the user inside the container that will start the process inside the container that is different from the owner of the container.