<p>No the root in container is a root-user of container. Remember containers runs isolated.
DOcker uses cgroups and libvirt of kernel linux.</p>

CC BY-SA 4.0
2020-02-29T02:06:02.313Z
Hold on, if you just run a docker container and you are UID 0 in that container, and (as an example) you have mounted in some root owned files into the container then my understanding was that without adding the additional security mechanisms provided by docker (and most container management interfaces) such as selinux or user namespaces etc. that you would be able to behave as UID 0 with regards to doing things to those files that were root owned on the host.
hvindin
CC BY-SA 4.0
2020-12-16T22:49:00.383Z
@hvindin that sounds accurate. here is one thing to consider though - platforms like GCP or AWS don't do nothin to stop you using `USER root` in a Dockerfile, if you could jump out of the container on their platforms then they wouldn't be happy but sounds secure enough, and they prevent you from jumpin out by not sharing root volumes maybe idk.
Alexander Mills
CC BY-SA 4.0
2021-08-29T01:30:25.603Z
@hvindin is correct, the UID is the same both inside and outside the container.  Any files created would be owned by root, and any files accessed are checked against UID 0 for access permissions.  Docker's security model considers programs inside a container as potential threat, but entirely trusts whoever is running the `docker run` command.

From https://docs.docker.com/engine/security/#docker-daemon-attack-surface, "only trusted users should be allowed to control your Docker daemon".  Anyone who can run docker has root access to the host device.
Eldritch Cheese
CC BY-SA 4.0
2020-01-31T13:42:49.263Z
2020-01-31T13:42:49.263Z
Vader
<p>Is the root user in a Docker image/container the same as the root user of the machine? I am curious about the security implications of using the root user in the Docker image.</p>

<p>TMK, the container is run by a non-root user (often the user is called "docker") and that user launched the docker-dameon. And the docker daemon launches the container process.</p>

<docker><docker-daemon>
Is the root user in a Docker image/container the same as the root user of the machine?
Alexander Mills
# Is the root user in a Docker image/container the same as the root user of the machine?

(Asked by: username_0 on 2020-01-30)

Is the root user in a Docker image/container the same as the root user of the machine? I am curious about the security implications of using the root user in the Docker image.

TMK, the container is run by a non-root user (often the user is called "docker") and that user launched the docker-dameon. And the docker daemon launches the container process.

**Tags:** docker, docker-daemon


---

## 1 answers

### Answer by username_1 on 2020-01-31. Score: 3 | Accepted answer

No the root in container is a root-user of container. Remember containers runs isolated.
DOcker uses cgroups and libvirt of kernel linux.

> **Comments:**
> **username_2**: Hold on, if you just run a docker container and you are UID 0 in that container, and (as an example) you have mounted in some root owned files into the container then my understanding was that without adding the additional security mechanisms provided by docker (and most container management interfaces) such as selinux or user namespaces etc. that you would be able to behave as UID 0 with regards to doing things to those files that were root owned on the host.  
> **username_0**: @username_2 that sounds accurate. here is one thing to consider though - platforms like GCP or AWS don't do nothin to stop you using `USER root` in a Dockerfile, if you could jump out of the container on their platforms then they wouldn't be happy but sounds secure enough, and they prevent you from jumpin out by not sharing root volumes maybe idk.  
> **username_3**: @username_2 is correct, the UID is the same both inside and outside the container.  Any files created would be owned by root, and any files accessed are checked against UID 0 for access permissions.  Docker's security model considers programs inside a container as potential threat, but entirely trusts whoever is running the `docker run` command.  From https://docs.docker.com/engine/security/#docker-daemon-attack-surface, "only trusted users should be allowed to control your Docker daemon".  Anyone who can run docker has root access to the host device.  

---

