# Ensure that a user for the container has been created

- Source: https://support.icompaas.com/support/solutions/articles/62000234364-ensure-that-a-user-for-the-container-has-been-created
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1**
    

**Description:**

A dedicated user should be created for running Docker containers. This ensures that containers run with their own non-root user instead of root privileges, reducing the risk of privilege escalation in case a container is compromised.

**Rationale:**

Running containers as root poses a significant security risk because any vulnerabilities or misconfigurations in the container could lead to complete system compromise. By creating a user specifically for containers, you ensure that containers only have access to the necessary resources and cannot escalate to root privileges on the host system.

**Impact:**

**Pros:**

-   Enhances security by isolating containers from the host system.
    
-   Prevents containers from using root privileges, limiting potential damage in the event of a breach.
    

**Cons:**

-   Some containers or applications might require additional configuration or permissions to run as a non-root user.
    

**Default Value:**

By default, Docker containers are run with root privileges unless explicitly configured to use a non-root user.

**Pre-requisites:**

-   Administrative privileges on the Docker host system.
    
-   Understanding of the containers that will be run and their user requirements.
    

**Remediation:**

**Test Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance running Docker.
    
2.  Verify if a non-root user has been created for container execution by checking the /etc/passwd file:  
    

**Using AWS CLI:**

1.  Connect to the EC2 instance where Docker is running.
    
2.  Run the following command to check if a container user exists:  
    
    cat /etc/passwd | grep <container-user-name>
    

**Implementation Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.
    
2.  Create a non-root user for Docker containers:  
    
    sudo useradd dockeruser
    
3.  Add the user to the docker group to allow it to run Docker commands:  
    
    sudo usermod -aG docker dockeruser
    
4.  Verify the user creation:  
    
    cat /etc/passwd | grep dockeruser
    
5.  Restart Docker if necessary for the user configuration to take effect.
    

**Using AWS CLI:**

1.  Use SSM to create a non-root user and add it to the docker group:  
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sudo useradd dockeruser && sudo usermod -aG docker dockeruser"\]'
    

**Backout Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.
    
2.  Remove the non-root user if necessary:  
    
    sudo userdel dockeruser
    
3.  Remove the user from the docker group if needed:  
    
    sudo gpasswd -d dockeruser docker
    
      
    

**Using AWS CLI:**

1.  Use SSM to delete the non-root user:  
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sudo userdel dockeruser"\]'
    

**References:**

-   [Dockerfile USER Directive](https://docs.docker.com/engine/reference/builder/#user)
    
-   [Docker Run USER Option  
      
    ](https://docs.docker.com/engine/reference/run/#user)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.