This product is not supported for your selected Datadog site. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Metadata
ID:docker-best-practices/useradd-l-flag
Language: Docker
Severity: Warning
Category: Best Practices
Description
When building Docker images, using useradd -l ensures that the new user is created without adding entries to system login tracking files like /var/log/lastlog or /var/log/faillog. These files are irrelevant in containers since they don’t persist user sessions or keep login histories, and in minimal images they may not even exist, which can lead to errors or unnecessary file creation during build.
This makes your image smaller, cleaner, and more reliable. Since containers are designed to run processes rather than serve as full login environments, disabling login record tracking speeds up builds, avoids warnings, and follows best practices for lightweight, secure Docker images.
Non-Compliant Code Examples
RUN useradd -u 123456 foobar
Compliant Code Examples
RUN useradd -l -u 123456 foobar
1
2
rulesets:- docker-best-practices # Rules to enforce Docker best practices.
