Add USER instruction
Recipe ID
org.openrewrite.docker.AddUserInstructionArtifact
org.openrewrite:rewrite-dockerAdds a USER instruction to run the container as a non-root user (CIS Docker Benchmark 4.1). By default, adds to the final stage only and skips if a USER instruction already exists.
Usage
You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.docker.AddUserInstruction --recipe-option "userName=appuser"If the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite:rewrite-docker:8.88.0Options
| Name | Type | Description |
|---|---|---|
userNamerequired | String | The username to run as. e.g. appuser |
groupName | String | The group name. If specified, the USER instruction will be USER user:group.e.g. appgroup |
stageName | String | Only add the USER instruction to this build stage. If null, adds to the final stage only. e.g. final |
skipIfUserExists | Boolean | If true (default), skip adding USER if the stage already has a USER instruction. If false, always add the USER instruction at the end of the stage. |
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats