Understanding Docker user/uid creation

Question

Even after going through lot of materials and SO answers still I'm not clear on docker uid/user usage or implementation.

I understand the below points:

1. An instance of an image is called a container.
2. uid/gid is maintained by the underlying kernel, not by Container.
3. Kernel understand uid/gid number not username/groupname and name is an alias and just for human readable.
4. All containers are processes maintained by docker daemon and will be visible as process in host machine (ps -ef)
5. root (id = 0) is the default user within a container and this can be changed either by USER instruction in Dockerfile or by passing -u flag in docker run

With the above all said, when I have the below command in my Dockerfile, I presume that a new user (my-user) will be created with incremented uid.

RUN addgroup my-group && adduser -D my-user -G my-group

• What happens if I run the same image multiple times i.e multiple containers? Will the same uid be assigned to all processes?

• What happens if I add same above command in another image and run that image as container? - will I get new uid or same uid as the previous one?

• How the uid increment happens in Container in relation with the host machine.

Any pointers would be helpful.

Answer 1

Absent user namespace remapping, there are only two things that matter:

1. What the numeric user ID is; and
2. What's in the /etc/passwd file.

Remember that each container and the host have separate filesystems, so each of these things could have separate /etc/passwd files.

What happens if I run the same image multiple times i.e multiple containers? Will the same uid be assigned to all processes?

Yes, because each container gets a copy of the same /etc/passwd file from the image.

What happens if I add same above command in another image and run that image as container? - will I get new uid or same uid as the previous one?

It depends on what adduser actually does; it could be the same or different.

How the uid increment happens in Container in relation with the host machine.

They're completely and totally independent.

Also remember that you can docker push/docker pull a built image to run it on a different host. That will bring the image's /etc/passwd file along with it, but the host environment could be totally different. Correspondingly, it's not a best practice to try to match some specific host's uid mapping in a Dockerfile, because it will be wrong if you try to run the same image anywhere else.