Odtnhj

I have a dockerfile with a user created so it is not running as root(best pratice)

FROM microsoft/dotnet:sdk AS build-env
WORKDIR /app

# Copy csproj and restore as distinct layers
COPY *.csproj ./
RUN dotnet restore

# Copy everything else and build
COPY . ./
RUN dotnet publish -c Release -o out

# Build runtime image
FROM microsoft/dotnet:aspnetcore-runtime

RUN groupadd -g 1001 appuser && useradd -r -u 1001 -g appuser appuser
USER appuser

WORKDIR /app
COPY --from=build-env /app/out .
ENTRYPOINT ["dotnet", "ConsoleApp32.dll"]

I build the image and run the container:

docker build -f Dockerfile1 -t myappimage .
docker run -d --name myapp myappimage

And then check it running:

ps aux | grep dotnet
21569 1001 0:00 dotnet ConsoleApp32.dll

So running as uid 1001.
I then check host for this user:

cut -d: -f1 /etc/passwd
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
man
postmaster
cron
ftp
sshd
at
squid
xfs
games
postgres
cyrus
vpopmail
ntp
smmsp
guest
nobody
dockremap

No sign of appuser. My understanding(which may be wrong) is we are using a shared Kernel and user should be in list.
I also looked up uid

getent passwd 1001

Which returned no result.
Can someone explain this, as I dont understand how a process is running on host as a uid of 1001 and there is no associated user

The user ID is shared with the host: it’s 1001. The name of that user comes from looking it up in the /etc/passwd file. Since the host and container have different filesystem spaces, they have different passwd files; the kernel doesn’t know anything about a user’s name.

The corresponding FAQ: it doesn’t matter if you have users named pat on both the host and in the container; if their numeric user IDs don’t match up, and you’re on Linux, and you’re trying to share content with docker run -v, one user won’t be able to access the other’s files.