Switching users inside Docker image to a non-root user

Question

I'm trying to switch user to the tomcat7 user in order to setup SSH certificates. When I do `su tomcat7`, nothing happens. `whoami` still ruturns root after doing `su tomcat7` Doing a `more /etc/passwd`, I get the following result which clearly shows that a tomcat7 user exists: ``` root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh…

Accepted Answer

You should not use `su` in a dockerfile, however you should use the `USER` instruction in the Dockerfile.

At each stage of the Dockerfile build, a new container is created so any change you make to the user will not persist on the next build stage.

For example:

```
RUN whoami
RUN su test
RUN whoami
```

This would never say the user would be `test` as a new container is spawned on the 2nd whoami. The output would be root on both (unless of course you run USER beforehand).

If however you do:

```
RUN whoami
USER test
RUN whoami
```

You should see `root` then `test`.

Alternatively you can run a command as a different user with sudo with something like

```
sudo -u test whoami
```

But it seems better to use the official supported instruction.

Switching users inside Docker image to a non-root user

Solution

Problem