Specify ID for both nginx user and group

[dp-anto]

Feature Overview

Currently the user and group nginx set their IDs to 101:

&& addgroup -g 101 -S nginx \
&& adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \

This ID can sometimes conflict with an existing host user generating possible security risks.
Would it be possible to set an ID above 1000 just to reduce the probabilities of conflicts or, alternatively, would it be possible to specify the ID while creating the container?

Alternatives Considered

No response

Additional Context

No response

[yosifkit]

I am pretty sure this is mostly just using --user on docker run with whatever UID you want. See also https://hub.docker.com/_/nginx#running-nginx-as-a-non-root-user (or github permalink).

[dp-anto]

@yosifkit This will apply to the main process, but that's not the point of my question. I'm worried about the user assigned to the child processes which has an ID that could conflict with an host user.

[thresheek]

There's been a bunch of discussions over the years about it... just changing UID to another number doesnt really solve the conflict issue as there is always a chance they can collide with something on the OS.

A proper solution is to either use what @yosifkit suggests in their comment, or use/rebuild unprivileged images with a UID/GID of your liking over at https://github.com/nginx/docker-nginx-unprivileged/?tab=readme-ov-file#nginx-unprivileged-docker-image