Many base images default to root. What should a professional Docker…

Question

Many base images default to root. What should a professional Dockerfile for a parks reservation API do before the process starts?

Accepted Answer

Create a non-root user and switch to it with USER so the process does not run as container root — Running as root inside the container is like leaving the master key in the ignition. Creating a non-root USER and switching to it shrinks the blast radius if the process is compromised.

Answer

Leave the default root user so package managers always succeed at run time

Answer

Rely on EXPOSE alone to drop privileges after the port is bound

Answer

Bake SSH host keys as root so operators can patch the live container

Many base images default to root. What should a professional Dockerfile for a parks reservation API do before the process starts?

Short Explanation

Full Explanation