<p>I'm not asking how to create a rootless container from scratch. Rather, I've been given some software deployed as pre-built Docker container images that run as root by default. I need to modify these containers so they can be deployed on Kubernetes, which means I need to make these containers rootless. To be clear, I DO NOT have the source to these containers so I can't simply rebuild them from scratch.</p>
<p>I've found plenty of articles about building rootless containers in general, but they all assume you're building your containers from scratch. I've spent hours searching but can't find anything about modifying an existing container to be rootless.</p>
<p>I realize this might be a very open question, but I don't know all the things I need to take into consideration. Two things I've been able to gather is adding a line such as <code>USER 1000</code> to Dockerfile, and adjusting ownership and permissions on certain files and folders. Beyond that, I'm not sure what I need to do.</p>

<p>Create users in the container and switch users;</p>
<pre><code> Add a new user, named user;
 Let this user have root privileges;
 Set its password to password;
 After the Container is started, log in as user and go directly to the user's home directory;
</code></pre>
<p>Put the following code snippet in the Dockerfile.</p>
<pre><code>RUN useradd --create-home --no-log-init --shell /bin/bash user \
&amp;&amp; RUN adduser user sudo \
&amp;&amp; RUN echo 'user:password' | chpasswd

USER user
WORKDIR /home/user
</code></pre>
<p>Use fixuid to modify the uid and gid of non-root users in the container;</p>
<p>After creating a non-root user with the above code, the user's uid and gid are generally 1000:1000.</p>
<p>Docker and the host share a set of kernel, and there is still only one set of uid and gid controlled by the kernel. In other words, we execute the process as a newly created docker user (uid 1000) in the container, and the host will think that the process is executed by a user with a uid of 1000 on the host, and this user may not necessarily be our account, which is equivalent to us A user who has replaced someone else with an impostor makes it difficult to trace back to the real user.</p>
<p>To solve this problem, you can specify the uid as the user's uid when adding the user, such as 1002;</p>
<pre><code>RUN addgroup --gid 1002 docker &amp;&amp; \
    adduser --uid 1002 --ingroup docker --home /home/docker --shell /bin/sh  --gecos &quot;&quot; docker
</code></pre>
<p>A better solution is to use fixuid to switch the uid when the container starts:</p>
<pre><code>
RUN useradd --create-home --no-log-init --shell /bin/bash user\
&amp;&amp; adduser user sudo \
&amp;&amp; echo 'user:password' | chpasswd


RUN USER=user &amp;&amp; \
    GROUP=docker &amp;&amp; \
    curl -SsL https://github.com/boxboat/fixuid/releases/download/v0.4.1/fixuid-0.4.1-linux-amd64.tar.gz | tar -C /usr/local/bin -xzf - &amp;&amp; \
    chown root:root /usr/local/bin/fixuid &amp;&amp; \
    chmod 4755 /usr/local/bin/fixuid &amp;&amp; \
    mkdir -p /etc/fixuid &amp;&amp; \
    printf &quot;user: $USER\ngroup: $GROUP\n&quot; &gt; /etc/fixuid/config.yml

USER user:docker
ENTRYPOINT [&quot;fixuid&quot;]
</code></pre>
<p>At this time, you need to specify the uid and gid when starting the container. The command is as follows:</p>
<pre><code>docker run --rm -it -u $(id -u):$(id -g) image-name bash
</code></pre>
