Description

Identifies Docker containers configured without an explicit user definition in their Dockerfile, which causes containers to run as root by default. Running containers with root privileges poses security risks as it gives unnecessary elevated permissions that could be exploited if the container is compromised.

Detection Strategy

• Check Dockerfile content for absence of USER instruction

• Report vulnerability if no USER directive is found in the Dockerfile

• Each line without USER specification in Dockerfile is flagged

Vulnerable code example

# First stage
FROM ubuntu:20.04 AS base
WORKDIR /app
COPY . .
RUN npm install

# Second stage
FROM node:16 AS builder...

✅ Secure code example

# Examples — Docker user best practices

# Case A — Multi-stage: create user in builder and set user in final
FROM golang:1.20 AS builder
RUN useradd -m builderuser
WORKDIR /src
# build steps...
RUN go build -o /app...