Store and Restore Inherited Dockerfile USER setting

Question

I'm looking how can I store and restore the USER from an inherited docker image in a Dockerfile. My parent image for example specifies a default service and sets USER to serviceuser.

Now I have a depending image that inherits from the parent image, does some modifications as root, but want's to keep the docker image user to serviceuser.

I can do this manually:

parent Dockerfile:

from default
USER serviceuser
ENTRYPOINT ["some-service"]

other Dockerfile:

from parent
USER root
RUN apt-get install -y cool-stuff
USER serviceuser

However, this way when I change the user in parent I have to update all child images. Is there a way to dymaically do this in the child Dockerfile?

Other options I thought about are to use sudo in the child script or running the entrypoint as root (i.e. not setting USER) and doing the service user switch in the start script. But both have security implications.

Answer 1

If you are author of parent image you can do this like this:

ENV serviceuser=foo
RUN useradd $serviceuser
USER $serviceuser

child image:

USER root
RUN apt-get install -y cool-stuff
USER $serviceuser