How to Run .NET Core 2 Applications in Docker on Linux as Non-Root Users

Описание: Learn how to securely run your `.NET Core 2` applications in Docker on Linux without root privileges. Find out the correct method to set up user permissions and avoid common pitfalls.
---
This video is based on the question https://stackoverflow.com/q/53544469/ asked by the user 'David L. Sargent' ( https://stackoverflow.com/u/664607/ ) and on the answer https://stackoverflow.com/a/63636705/ provided by the user 'David L. Sargent' ( https://stackoverflow.com/u/664607/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: How to run .NET Core 2 application in Docker on Linux as non-root

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
How to Run .NET Core 2 Applications in Docker on Linux as Non-Root Users

When working with Docker, security is often a primary concern, especially when building applications. One of the most common best practices is to run your applications as a non-root user within your Docker containers. In this guide, we’ll walk through how to run a .NET Core 2 application in Docker on Linux without root privileges, addressing common issues you might encounter along the way.

The Problem

You may find yourself in a situation where your .NET Core 2 web API application runs successfully in Docker, but you want to follow security best practices by running it under a custom user instead of as root. Running applications as root can expose your system to security vulnerabilities, so it’s important to configure your Docker containers properly.

However, after switching to a custom user, you might encounter errors during startup, such as the following Kestrel error message:

[[See Video to Reveal this Text or Code Snippet]]

This error typically indicates that the application does not have the necessary permissions to bind to the specified ports.

Solution Overview

To successfully run a .NET Core 2 application as a non-root user in Docker, follow these steps:

Create a Group and User: Set up a non-root user and group within your Dockerfile.

Expose the Correct Port: Since you cannot bind to the default port 80 with a non-root user, you’ll need to serve on a different port, such as 8080.

Set User Context: Specify that all future commands should run under the context of the newly created non-root user.

Step-by-Step Guide

1. Create a Group and User

In your Dockerfile, add the following lines to create a non-root user and group.

[[See Video to Reveal this Text or Code Snippet]]

This code snippet does the following:

Custom Group: customgroup is created with a system group ID of 1000.

Custom User: customuser is created and associated with customgroup, also granted a user ID of 1000.

2. Expose the Correct Port

Since running on port 80 is not possible for non-root users, expose port 8080 instead. Modify your Dockerfile by adding the following lines:

[[See Video to Reveal this Text or Code Snippet]]

This configuration sets the environment variable acknowledging that your application will serve traffic on port 8080.

3. Set User Context

Finally, ensure that all subsequent commands in your Dockerfile are executed as the customuser:

[[See Video to Reveal this Text or Code Snippet]]

This command designates that your application processes will run with the privileges of customuser, enhancing your security posture.

Example Dockerfile

Here is a complete example including the above steps combined with your original setup:

[[See Video to Reveal this Text or Code Snippet]]

Conclusion

By following the steps outlined above, you can successfully run your .NET Core 2 application inside a Docker container as a non-root user. This ensures adherence to best practices for security while allowing your application to run smoothly. If you face any issues, check the permissions and ensure that the appropriate ports are exposed without root access.

Don't hesitate to reach out for further assistance or clarification on this topic as you dive deeper into Docker and .NET Core development!