Metadata

ID: docker-best-practices/useradd-l-flag

Language: Docker

Severity: Warning

Category: Best Practices

Description

When building Docker images, using useradd -l ensures that the new user is created without adding entries to system login tracking files like /var/log/lastlog or /var/log/faillog. These files are irrelevant in containers since they don’t persist user sessions or keep login histories, and in minimal images they may not even exist, which can lead to errors or unnecessary file creation during build.

This makes your image smaller, cleaner, and more reliable. Since containers are designed to run processes rather than serve as full login environments, disabling login record tracking speeds up builds, avoids warnings, and follows best practices for lightweight, secure Docker images.

Non-Compliant Code Examples

RUN useradd -u 123456 foobar

Compliant Code Examples

RUN useradd -l -u 123456 foobar

Integraciones sin problemas. Prueba Datadog Code Security

Datadog Code Security