Create a common non-root user in runtime images

[bwateratmsft]

Many guides suggest using not-root as the user for runtime, and in general that is a good security practice. Can a user be added into the runtime base images, to simplify the work downstream?

Related to microsoft/vscode-docker#1766.

[bwateratmsft]

Example:
RUN useradd --create-home netcoreuser

[MichaelSimons]

A good point to reconsider.

The original thinking was that consumers would define the user(s) they wanted within their own layers. If we define a usergroup and it they aren;t used or not the name/UID/GID the consumer wants, the .NET layer adds bloat/negative value. This is particularly important for Alpine scenarios.

Dockerfile best practices around USER. One specific point called out is to explicitly assign the UID/GID.

Any changes in this space should be considered a breaking change and should only be considered for new major/minor releases.

[MichaelSimons]

The .NET team discussed this. The question we asked ourselves is what is our role as the producers of the .NET core base image related to this topic? We came up with the two points.

1. Provide best practices guidance. We don't have this today. I will be logging logged an issue to add guidance to our documentation and samples.
2. Don't get in the way. If we define a low privileged user in the .NET Core images will it be widely adopted and used? Will the user/group name be what users want? Will the user/group id be what users want? We don't have a sense that it would be. If the user isn't widely adopted and used then what we have done is actually bloat the .NET Core images and made them less attractive to a wide audience. This is especially important with the Alpine images.

We are not going to make this change. We would like to hear from users if this is something that users want.