Answers: <p>No the root in container is a root-user of container. Remember containers runs isolated.
  DOcker uses cgroups and libvirt of kernel linux.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-29T02:06:02.313Z
Answers: Hold on, if you just run a docker container and you are UID 0 in that container, and (as an example) you have mounted in some root owned files into the container then my understanding was that without adding the additional security mechanisms provided by docker (and most container management interfaces) such as selinux or user namespaces etc. that you would be able to behave as UID 0 with regards to doing things to those files that were root owned on the host.
Answers: hvindin
Answers: CC BY-SA 4.0
Answers: 2020-12-16T22:49:00.383Z
Answers: @hvindin that sounds accurate. here is one thing to consider though - platforms like GCP or AWS don't do nothin to stop you using `USER root` in a Dockerfile, if you could jump out of the container on their platforms then they wouldn't be happy but sounds secure enough, and they prevent you from jumpin out by not sharing root volumes maybe idk.
Answers: Alexander Mills
Answers: CC BY-SA 4.0
Answers: 2021-08-29T01:30:25.603Z
Answers: @hvindin is correct, the UID is the same both inside and outside the container.  Any files created would be owned by root, and any files accessed are checked against UID 0 for access permissions.  Docker's security model considers programs inside a container as potential threat, but entirely trusts whoever is running the `docker run` command.
  
  From https://docs.docker.com/engine/security/#docker-daemon-attack-surface, "only trusted users should be allowed to control your Docker daemon".  Anyone who can run docker has root access to the host device.
Answers: Eldritch Cheese
Answers: CC BY-SA 4.0
Answers: 2020-01-31T13:42:49.263Z
Answers: 2020-01-31T13:42:49.263Z
Answers: Vader
Body: <p>Is the root user in a Docker image/container the same as the root user of the machine? I am curious about the security implications of using the root user in the Docker image.</p>
  
  <p>TMK, the container is run by a non-root user (often the user is called "docker") and that user launched the docker-dameon. And the docker daemon launches the container process.</p>
  
Tags: <docker><docker-daemon>
Title: Is the root user in a Docker image/container the same as the root user of the machine?
UserDisplayName: Alexander Mills
ThreadText: # Is the root user in a Docker image/container the same as the root user of the machine?
  
  (Asked by: username_0 on 2020-01-30)
  
  Is the root user in a Docker image/container the same as the root user of the machine? I am curious about the security implications of using the root user in the Docker image.
  
  TMK, the container is run by a non-root user (often the user is called "docker") and that user launched the docker-dameon. And the docker daemon launches the container process.
  
  **Tags:** docker, docker-daemon
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-01-31. Score: 3 | Accepted answer
  
  No the root in container is a root-user of container. Remember containers runs isolated.
  DOcker uses cgroups and libvirt of kernel linux.
  
  > **Comments:**
  > **username_2**: Hold on, if you just run a docker container and you are UID 0 in that container, and (as an example) you have mounted in some root owned files into the container then my understanding was that without adding the additional security mechanisms provided by docker (and most container management interfaces) such as selinux or user namespaces etc. that you would be able to behave as UID 0 with regards to doing things to those files that were root owned on the host.  
  > **username_0**: @username_2 that sounds accurate. here is one thing to consider though - platforms like GCP or AWS don't do nothin to stop you using `USER root` in a Dockerfile, if you could jump out of the container on their platforms then they wouldn't be happy but sounds secure enough, and they prevent you from jumpin out by not sharing root volumes maybe idk.  
  > **username_3**: @username_2 is correct, the UID is the same both inside and outside the container.  Any files created would be owned by root, and any files accessed are checked against UID 0 for access permissions.  Docker's security model considers programs inside a container as potential threat, but entirely trusts whoever is running the `docker run` command.  From https://docs.docker.com/engine/security/#docker-daemon-attack-surface, "only trusted users should be allowed to control your Docker daemon".  Anyone who can run docker has root access to the host device.  
  
  ---
  
  