Image runs as root (ARCH10001)

Key config.docker.runs-as-root · Severity warning · Category security · CWE CWE-250

A container whose process runs as root gives an attacker who breaks into it root inside the container, and every misconfiguration around it (a mounted host path, an extra capability, a kernel bug) is then worth more. The rule reads the final stage: no USER after a base image known to start as root, or USER root / USER 0.

Incorrect

FROM node:22.11-alpine
WORKDIR /app
COPY . .
CMD ["node", "server.js"]

Correct

FROM node:22.11-alpine
WORKDIR /app
COPY --chown=node:node . .
USER node
CMD ["node", "server.js"]

Fix

Add a USER with a non-root account to the final stage. Official images usually ship one (node, nobody); Microsoft’s .NET images have $APP_UID.

Not flagged

• A base image this checker does not know (your company’s own image): its user cannot be read from the Dockerfile.
• Chiseled and distroless .NET images, and images whose name says nonroot, unprivileged or rootless: they start as a non-root user.
• A USER set in an earlier stage that the final stage is built from (FROM build).