title: non-privileged execution FROM scratch
body: <p>I'm building/deploying go/golang micro-services on images FROM scratch.</p>
  
  <p>Is it possible to specify non-privileged execution on an image built this way -- there are only two files on the image–the go executable and a root certificate file–so there doesn't seem to be any concept of privilege within the container.</p>
  
  <p>I also use read-only containers and --selinux-enabled=true --icc=false --iptables=true, but would feel more warm and fuzzy if I knew that the executable was running as a "common" non-privileged user.</p>