Does docker image have to be run as root

[Kagemusha-san]

Hello all,

we want to add open search to our stack for displaying traces, metrics and logs collected through Open Telemetry Collector. One prerequisite is to not have any docker containers run as root (which is also a best practice). While opensearchproject/opensearch and opensearchproject/opensearch-dashboards run without root, opensearchproject/data-prepper runs as root.

Is there a special reason for this or can this be changed?

[Kagemusha-san]

Since I got no answer yet, I tested with a custom data-prepper image that switches to a custom user

FROM opensearchproject/data-prepper:latest

RUN yum install shadow-utils -y

RUN groupadd -g 1000 data-prepper && \
    adduser -u 1000 -g 1000 -G 0 -d /usr/share/data-prepper data-prepper && \
    chmod 0775 /usr/share/data-prepper && \
    chown -R 1000:0 /usr/share/data-prepper

USER 1000

CMD ["bin/data-prepper"]

Everything seems to work correctly. Would be nice to hear if this is a good approach or if you plan to remove root user in the future.