Creating a New User with Dockerfile: adduser --disabled-password

Creating a New User with Dockerfile: adduser --disabled-password

In this article, we will discuss how to create a new user in a Dockerfile using the adduser command with a disabled password. This is particularly useful when you want to create a user that is not meant for interactive login, but rather for running specific services or applications within the container.

Why Disable the Password?

Disabling the password for a user is a security best practice when the user is not intended for interactive login. This prevents the user from being able to log in via SSH or other means, reducing the attack surface of the system. Additionally, it ensures that the user can only perform actions that are explicitly allowed by the system's permissions and file ownership rules.

Creating the User in a Dockerfile

To create a new user with a disabled password in a Dockerfile, you can use the following command:

Let's break down this command:

• adduser: This is the command used to add a new user to the system.
• --disabled-password: This option tells the command to disable password authentication for the user.
• --gecos "": This option sets the user's GECOS field to an empty string. The GECOS field is a legacy field used to store the user's full name and other information. Setting it to an empty string is a harmless way to satisfy the requirement that it be set to something.
• smart-home: This is the username being created.
• tty-user and tty-group: These are the user and group names that will own the user's TTY device files. They are optional, but recommended for proper file ownership and permissions.

Using the New User

Once the user has been created, you can switch to it using the su command:

From this point on, any commands run in the Dockerfile will be run as the smart-home user. This is useful for running services or applications that require specific permissions or file ownership rules.

In this article, we have discussed how to create a new user with a disabled password in a Dockerfile using the adduser command. This is a useful technique for creating users that are not meant for interactive login, but rather for running specific services or applications within the container. By disabling the password, we can reduce the attack surface of the system and ensure that the user can only perform actions that are explicitly allowed by the system's permissions and file ownership rules.

References

• adduser(8) man page
• Dockerfile USER instruction