---
title: Containers should run as a non-root user
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should run as a non-root
  user
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should run as a non-root user
Classification:complianceFramework:cis-dockerControl:4.1 
## Description{% #description %}

Containers should run as a user other than root.

## Rationale{% #rationale %}

A process that escapes a container keeps its user. If it runs as an unprivileged user, it lands on the host without root privileges.

## Audit{% #audit %}

Show the user of the running containers:

```bash
docker ps --quiet | xargs docker inspect --format '{{ .Name }}: User={{ .Config.User }}'
```

Datadog checks the running containers. It passes the rule when the container's user, before any `:`, is set and is other than `root` and the UID 0, in any spelling that Docker reads as 0, such as `00`, and fails it otherwise. A container that drops privileges in its entrypoint fails, and needs a manual review.

## Remediation{% #remediation %}

Add a user to the image and switch to it with a `USER` instruction in the Dockerfile:

```dockerfile
RUN useradd -r -u 10001 app
USER app
```

Or run the container with `--user`.

## Impact{% #impact %}

Programs that need root inside the container stop working.

## Default value{% #default-value %}

Containers run as root unless the image or the command sets a user.

## References{% #references %}

1. [https://docs.docker.com/reference/dockerfile/#user](https://docs.docker.com/reference/dockerfile/#user)
1. [https://docs.docker.com/engine/containers/run/#user](https://docs.docker.com/engine/containers/run/#user)