title: docker-node: Running as non-root user, file permissions
body: <p>Following docker-node’s <a href="https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user" rel="noreferrer">best practices</a>, I want to run my node app as non-root user. The recommendation is as follows:</p>
  
  <pre class="lang-none prettyprint-override"><code>FROM node:6.10.3
  ...
  # At the end, set the user to use when running this image
  USER node
  </code></pre>
  
  <p>My simplified Dockerfile currently looks like this:</p>
  
  <pre class="lang-none prettyprint-override"><code>FROM node:6.10.3
  WORKDIR /opt/app
  COPY package.json .
  RUN npm install
  COPY . .
  EXPOSE 3000
  USER node
  CMD ["node", "server.js"]
  </code></pre>
  
  <p>So, all the files added during image build are owned by <code>root</code>, but <code>node server.js</code> is run as the <code>node</code> user. This seems to work fine.</p>
  
  <p><strong>My question:</strong> Is there any additional security benefit from <code>chown</code>-ing the files so that they belong to <code>node</code> instead of <code>root</code>? I.e. doing something like:</p>
  
  <pre class="lang-none prettyprint-override"><code>RUN chown -R node:node .
  </code></pre>