The current USER directive changes the user which every RUN directive executes under. However, file copying instructions such as ADD and COPY are always copied with the owner being root:root. This was originally added in 026aebd, in order to fix #2684 and #3950. However, this results in an inconsistency in the Dockerfile interface, since USER can modify some directives, but not all of them.

I propose that the COPY directive should change the owner of any copied file to be the uid of the current user (as set by the USER directive and found by parsing /etc/shadow in the container -- or failing that, just setting it to nobody [65534]) and the gid should be the primary gid of the current user (as found by parsing the /etc/shadow file in the container -- or failing that, just setting it to nobody [65534]).

NOTE: After discussing this proposal on the IRC, it was decided that ADD should not be modified along the lines of this proposal (since it must be supported and backward compatible until it is deprecated and removed). To this end, I am only proposing that COPY should be modified, due to it's relative newness and since there is nowhere near as many backward compatibility concerns as with ADD.

EDIT: I propose a modification to the above proposal, such that:

• If the b.Config.User is set to an empty string, then the same method as used in libcontainer is applied -- syscall.Getuid() and syscall.Getgid() are used instead.
• If b.Config.User does not exist in /etc/passwd, then the builder emits an error.

Does anyone have any objections with the above modification to the proposal?

To assist in the tracking of patchsets and pull requests which are required to implement this proposal:

• Refactor and expose private functions within libcontainer/user. docker-archive/libcontainer#158: libcontainer patchset to expose internal functions for parsing and filtering /etc/{passwd,group} files (allowing arbitrary io.Readers and thus container /etc/{passwd,group} files to be parsed).
• Update vendor'd libcontainer and update to use new user interface. #9023: docker patch to use the above libcontainer patch.
• Implement USER setting owner of COPY'd files. #9046: actually implement the above proposal (and document it).

/ping @shykes and others.