Set a non-root user by default? about rocker

[eddelbuettel]

Sorry, root where?

On the host running docker? That is a local choice; I say no, am member of group docker and can run commands as myself.

Or inside the container? Who care, once I own the outside process as just me nothing is elevated.

[cboettig]

Perhaps the best thing to do is just have a RUN useradd user in r-base, and then at least you can always run the container with --user user instead of as root.

(Currently that won't work for rstudio since 'user' can't write to /var/log/supervisord, but I guess we could work around that).

[cboettig]

@eddelbuettel sorry, root inside the container, as per Docker's official recommendation. It makes a difference particularly when linking volumes, but poses other potential issues too as @wch points out in thread I linked and in the docker article.

[cboettig]

Okay, this now done in r-base as well. The user docker is created, but not set. We advise running containers with the flag --user docker to avoid having a root user. (Note that this is unnecessary for detached/daemonized shells -d such as would typically be used for running a persistent rstudio-server).