Docker / Images, Dockerfiles & Build Reliability
Check the final runtime user after a multi-stage image build
A final stage can unintentionally reset the runtime user and file ownership assumptions from an earlier stage. Inspect final-image metadata.
Environment and inputs: Docker Engine · Compose v2 and Buildx where specified; Linux containers unless noted. Verify daemon context, installed feature support and authorized host or Swarm manager access first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
docker image inspect --format '{{json .Config.User}} {{json .Config.WorkingDir}}' app:releaseRead the result
An empty User typically means the image does not set a non-root default, but runtime overrides and user namespaces can alter effective identity.
Resolve and verify
Compare the final stage and copied-file ownership with the application's supported least-privilege model. Correct the source image and test required reads, writes and startup.
Before changing production
Do not rely on an earlier build stage's USER directive to secure a different final stage.