Docker container runs as default root user

[driesejr]

Find more live information in Aikido here: https://app.aikido.dev/queue?sidebarIssue=16692888&groupId=39961&sidebarIssueTask=1526647&sidebarTab=tasks

Scope

This task includes issues in the following code repository:

• vmt-mode-shift-study: Dockerfile at line 1

TLDR

By default, containers are run with root privileges and also run as the root user inside the container. Running the app as root gives a hacker who was able to hack the application instant root access to the Docker host, which could help them to escalate a hack.

How to fix

Add 'USER username' to the end of your file.