Users, Groups and Permissions
You start quicknotes in a container and run whoami inside it. The answer is root. That surprises most people, and it matters: if someone finds a hole in quicknotes, they get whatever power that user has. Understanding Linux users and permissions lets you fix it.
The rule
Containers run as root unless you say otherwise — so say otherwise.
Linux identifies every user by a number, the UID, and every group by a GID. Names like root or app are just labels looked up in /etc/passwd; the kernel only cares about the numbers. root is always UID 0 and may do almost anything.
Every file has an owner, a group, and three sets of permission bits. ls -l shows them:
$ ls -l /app
-rw-r--r-- 1 root root 812 app.py
-rwxr-x--- 1 app app 143 start.shAfter the first character (- for a file, d for a directory) come three triplets of read, write and execute: for the owner, the group, and others. As numbers, r = 4, w = 2, x = 1, added per triplet, so rwxr-x--- is 750. You change them with chmod and change the owner with chown.
In a Dockerfile you create an ordinary user and switch to it before the app starts:
RUN useradd --create-home app
USER app
CMD ["python", "app.py"]From USER app onward, later instructions and the running container use that user instead of root.
The shortcut
Read permissions as three triplets: owner, group, others. Split the string after the first character into groups of three and read each group separately.
Drop the type
The first
-means a regular file. What remains isrwxr-x---.
A second trap appears with shared folders: since the kernel compares numbers, UID 1000 inside a container is the same UID 1000 on the host. If the container's user has a different UID from the files' owner, it may be refused access even though the names look right.
Drills
Answer fast — trust the rule.
Unless the image or command says otherwise, which user does a container's process run as?
A file shows -rwxr-x---. What can users outside the owner and group do?
Which permission string does chmod 755 start.sh produce?
How does the Linux kernel decide who owns a file?
Remember
- Containers run as root unless you say otherwise: create a user and add
USERbeforeCMD. - Read permissions as three triplets, owner, group, others; r = 4, w = 2, x = 1.
- Trap: the kernel compares numeric UIDs, not names, across container and host.