Running containers as root is a widespread but risky default inherited from Docker's behavior. This guide explains how to adapt container images to run as unprivileged users, using nginx-unprivileged as a real-world example covering port changes, file permission adjustments, and PID file relocation. It also covers two complementary approaches for cases where full rootlessness isn't feasible: Linux capabilities (granting specific privileges via --cap-add in Docker or securityContext in Kubernetes) and user namespaces (mapping container root to an unprivileged host user via /etc/subuid and userns-remap). User namespace support across runtimes including Podman, CRI-O, runc, containerd, and Kubernetes is documented with configuration examples.
Table of contents
The dangers of running as rootTradeoffs of running rootlessPrepare your image to be rootlessCapabilities and user namespacesConclusion3 Impressions