docker-no-root

星标0

分支0

更新时间2026年4月9日 22:01

Never run Docker containers as root. Enforce USER directive in Dockerfiles and user: in compose files. Database images are the only exception.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

open-hax

open-hax/eta-mu-pi

打开 GitHub 仓库查看创作者相关仓库

下载

Docker No-Root Policy

Invariant

No application container in any service stack may run as PID 1 root (user: 0:0).

Rules

Dockerfiles

If a Dockerfile installs global tools (corepack, pnpm, etc.) that need root, perform those RUN steps BEFORE the USER directive.
Always add USER 1000:1000 (or USER node if using official Node images) after all RUN steps that need elevated permissions.
The final CMD/ENTRYPOINT must execute as the non-root user.

docker-compose.yml

Application services using pre-built images (node:*, python:*, nginx:*, etc.) MUST have user: "${DOCKER_USER:-1000:1000}".
Services with custom Dockerfiles that contain USER directives do not need a compose-level user: (Dockerfile wins).
Database services (postgres, mongodb, redis, mysql, chromadb) manage their own users — skip them.
Init containers that create files for other services MAY use user: "0:0" with a comment # init container.
MongoDB search (mongot) placeholder containers MAY use root with a comment.

Shared Volume Mounts

When a bind mount is shared between containers with different users, root-owned files created by one container will block writes from non-root containers.
If you encounter EACCES errors in a non-root container, check for root-owned files in the shared mount from sibling containers.
Fix by either: (a) ensuring all containers sharing the mount use the same UID, or (b) running pnpm install / npm install in the container that owns the mount, not from the host.

Anti-Patterns (DO NOT)

Setting user: "0:0" on application services to work around permission issues.
Using npm install -g as non-root without a --prefix flag.
Running corepack enable as non-root on images where /usr/local/bin is root-owned.

Correct Pattern

FROM node:22-bookworm-slim
RUN corepack enable && corepack prepare pnpm@latest --activate
USER 1000:1000

同仓库更多 Skills

同仓库

pnpm-workspace-migration

open-hax/eta-mu-pi

Handle packages migrating between pnpm workspaces. Clean stale root copies, update workspace configs, fix broken workspace:* references.

2026-04-090

session-source-recovery

open-hax/eta-mu-pi

Recover lost source files from pi session history when files were deleted but never committed to git.

2026-04-090

clock-model-evolver

open-hax/eta-mu-pi

Improve the Hormuz clock model through new signal classes, schema changes, uncertainty modeling, and better rendering or branch logic

2026-04-060

fork-tax-concurrent-agent-guardrails

open-hax/eta-mu-pi

Revise fork-tax protocols so they assume concurrent agents by default in shared workspaces, forbid destructive repo-wide cleanup of unrelated dirt, and require path-scoped staging plus explicit blocker recording.

2026-04-040

fork-tax

open-hax/eta-mu-pi

Persist the full working state into git (commit + tag + push + manifest artifacts) as a deterministic handoff snapshot. Use when the user requests Π / fork tax / full dump.

2026-04-040

atproto-auth-standardization

open-hax/eta-mu-pi

Standardize human login, service identity, and inter-service auth around AT Protocol DIDs and Bluesky-backed one-time sign-in, while removing host-local static secrets and bespoke per-service auth flows.

2026-03-210

Docker No-Root Policy

Invariant

No application container in any service stack may run as PID 1 root (user: 0:0).

Rules

Dockerfiles

If a Dockerfile installs global tools (corepack, pnpm, etc.) that need root, perform those RUN steps BEFORE the USER directive.

Always add USER 1000:1000 (or USER node if using official Node images) after all RUN steps that need elevated permissions.

The final CMD/ENTRYPOINT must execute as the non-root user.

docker-compose.yml

Application services using pre-built images (node:*, python:*, nginx:*, etc.) MUST have user: "${DOCKER_USER:-1000:1000}".

Services with custom Dockerfiles that contain USER directives do not need a compose-level user: (Dockerfile wins).

Database services (postgres, mongodb, redis, mysql, chromadb) manage their own users — skip them.

Init containers that create files for other services MAY use user: "0:0" with a comment # init container.

MongoDB search (mongot) placeholder containers MAY use root with a comment.

Shared Volume Mounts

When a bind mount is shared between containers with different users, root-owned files created by one container will block writes from non-root containers.

If you encounter EACCES errors in a non-root container, check for root-owned files in the shared mount from sibling containers.

Fix by either: (a) ensuring all containers sharing the mount use the same UID, or (b) running pnpm install / npm install in the container that owns the mount, not from the host.

Anti-Patterns (DO NOT)

Setting user: "0:0" on application services to work around permission issues.

Using npm install -g as non-root without a --prefix flag.

Running corepack enable as non-root on images where /usr/local/bin is root-owned.

Correct Pattern

FROM node:22-bookworm-slim RUN corepack enable && corepack prepare pnpm@latest --activate USER 1000:1000

name	docker-no-root
description	Never run Docker containers as root. Enforce USER directive in Dockerfiles and user: in compose files. Database images are the only exception.
triggers	["docker","compose","container","Dockerfile","deploy"]

name	docker-no-root
description	Never run Docker containers as root. Enforce USER directive in Dockerfiles and user: in compose files. Database images are the only exception.
triggers	["docker","compose","container","Dockerfile","deploy"]