I've created an image with non-root user and always thought that you can't bind to ports < 1024 (I saw it in different guides and a lot of questions on StackOverflow). But for testing, I've create simple ASP.NET Core Web API (from template) and generated Dockerfile by VS Code (even VS Code thinks the same, if you generate Dockerfile for 5000 port it creates non-root user, but if you select 80 port then it creates image with root user).
Dockerfile:
FROM mcr.microsoft.com/dotnet/aspnet:5.0-focal AS base
WORKDIR /app
EXPOSE 80
ENV ASPNETCORE_URLS=http://+:80
# Creates a non-root user with an explicit UID and adds permission to access the /app folder
# For more info, please refer to https://aka.ms/vscode-docker-dotnet-configure-containers
RUN addgroup --gid 8765 appgroup
RUN adduser -u 5678 --gid 8765 --disabled-password --gecos "" appuser && chown -R appuser:appgroup /app
USER appuser:appgroup
FROM mcr.microsoft.com/dotnet/sdk:5.0-focal AS build
WORKDIR /src
COPY ["webapi.csproj", "./"]
RUN dotnet restore "webapi.csproj"
COPY . .
WORKDIR "/src/."
RUN dotnet build "webapi.csproj" -c Release -o /app/build
FROM build AS publish
RUN dotnet publish "webapi.csproj" -c Release -o /app/publish
FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "webapi.dll"]
Then build and run it:
docker build . -t test
docker run --rm -it -p 5000:80 test
And it works perfectly, then I check result of top command and it outputs that dotnet runs as appuser.
Is this restriction (root access to bind < 1024 ports) not valid anymore? Is it changed by newer versions of Docker or is it related to .NET?
According to docker run documentation, Docker adds several Linux capabilities (by default). One of them is NET_BIND_SERVICE, which allows:
Bind a socket to internet domain privileged ports (port numbers less than 1024).
But if I drop all capabilities by --cap-drop=all, it still works.
Tested on:
- Docker Desktop 3.5.2 (Mac OS / Windows 10)
- Linux Docker 20.10.7