DOCKER · Security · 8 min

Confirm the runtime user

Check both image configuration and the actual process UID.

Not completed

Your task

Inspect the image user and run id -u in a temporary container. Save the UID in uid.txt.

What you’re aiming for

The image user is 65534:65534.
uid.txt contains 65534.
The temporary container exits automatically.

1. Prepare your practice folder

Use a running Docker engine in Linux container mode. The setup commands below use a Bash-compatible shell: Git Bash on Windows, or Bash on Linux/macOS.

Create a new, empty folder for this exercise. If that name already exists, choose another new name. Continue only after you’re inside the new folder.

NEW PRACTICE FOLDER

mkdir opsrung-docker-inspect-runtime-user && cd opsrung-docker-inspect-runtime-user

Run these setup commands in that folder:

SETUP — RUN ONCE

cat > Dockerfile <<'DOCKERFILE'
FROM alpine:3.22
USER 65534:65534
CMD ["echo","Practice ready"]
DOCKERFILE
docker build -t opsrung-inspect-runtime-user:practice .

Docker may download the official Alpine image and, for the web task, its HTTP package. If an example container name already exists, use a different name consistently. If port 8088 is occupied, choose another free local port.

2. Try the task

Work toward the goal above. Start by inspecting the files or resources, then use a hint if you need one.

Hint 1

Image inspection and running a process answer related but different questions.

Hint 2

Arguments after the image replace its default CMD.

Hint 3

Run id -u with --rm and redirect its output into uid.txt.

3. Review your result

Use these commands to look at your result and compare it with the goals. The website does not run or verify them.

REVIEW IN YOUR TERMINAL

cat uid.txt
docker image inspect opsrung-inspect-runtime-user:practice --format "{{.Config.User}}"

What you should see

The image user is 65534:65534.
uid.txt contains 65534.
The temporary container exits automatically.

If your result differs: Compare the actual output with each goal. Keep your work inside this exercise’s folder and use only its named resources.

Compare with one possible solution

ONE POSSIBLE SOLUTION

docker image inspect opsrung-inspect-runtime-user:practice --format "{{.Config.User}}"
docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges opsrung-inspect-runtime-user:practice id -u > uid.txt

Other approaches are fine if you reach the same goal. Opening this solution does not mark the exercise complete.

Clean up this exercise

Only remove the example resources you created. Volume cleanup deletes that exercise’s saved sample data. Keep anything you need.

OPTIONAL CLEANUP

docker image rm opsrung-inspect-runtime-user:practice

Finished this exercise?

You decide when you’re done. Your choice is saved in this browser, and you can change it later.