38

What is the difference between docker run parameters:

   -u, --user=""
      Sets the username or UID used and optionally the groupname or GID for the specified command.

   The followings examples are all valid:
      --user [user | user:group | uid | uid:gid | user:gid | uid:group ]

   Without this argument the command will be run as root in the container.

and

   --group-add=[]
      Add additional groups to run as

?

2 Answers 2

60

docker run --user=demo_user <image_name> <command> runs a container with the given command as demo_user enter image description here

docker run --user=demo_user:group1 <image_name> <command> runs a container with the given command as demo_user whose primary group is set to group1 enter image description here

docker run --user=demo_user:group1 --group-add group2 <image_name> <command> runs a container with the given command as demo_user whose primary group is set to group1 and group2 as secondary group of the user enter image description here

NOTE: users and groups used for these options MUST have been created in the image of which we are creating a container. If --group-add option alone is specified without --user and the image does NOT have any user declared(user should have been created but not declared via USER instruction in Dockerfile from which the image got created), group modifications happen to the root user in the container.

If --group-add option alone is specified without --user and the image does have the user declared( via USER instruction in Dockerfile from which the image got created), group modifications happen to the declared user in the container.

2
  • 1
    About your note, are you sure that modifications will by applied to the root user. Shouldn't they be applied to the image's declared user instead (i.e. the user you're connected with if you don't provide the -u flag) ? Dec 12, 2016 at 14:49
  • 1
    @AlexandreFILLATRE. Yes, group is added as secondary group to the root user if --user is NOT provided AND the image does not have any user declared(user should have been created but not declared via USER instruction in Dockerfile). I updated the post accordingly.
    – YYY
    Dec 12, 2016 at 15:03
15

When you create a Docker image, you can also create users and groups inside it. Those options allow you to connect as a specific user (-u) and with additional groups (--group-add).

In other words, when you execute a process in a Docker container, you do so as the provided user, and its groups (defined in the system). You can tell the system that the current user has addition groups by using the --group-add flag, for the process' lifetime.

Check out the documentation here: https://docs.docker.com/engine/reference/run/#/additional-groups

$ docker run --rm --group-add audio --group-add nogroup --group-add 777 busybox id
uid=0(root) gid=0(root) groups=10(wheel),29(audio),99(nogroup),777

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.