title: User and file permission configuration in Docker containers (docker-compose version 3)
body: <p>Docker <a href="https://docs.docker.com/engine/security/security/#conclusions" rel="nofollow noreferrer">states</a> that its containers are </p>
  
  <blockquote>
    <p>"...by default, quite secure; especially if you take care of running your processes inside the
    containers as non-privileged users (i.e., non-root)"</p>
  </blockquote>
  
  <p>As a result, I've tried to:</p>
  
  <ol>
  <li>Use official images that handle user execution appropriately</li>
  <li>Avoid mounting host volumes in production, and using <code>COPY</code> instead</li>
  </ol>
  
  <p>When I <code>COPY</code> code and configuration files to my container volumes, all of the directories and files are created "...with a UID and GID of 0" (root ownership), as stated in the documentation <a href="https://docs.docker.com/engine/reference/builder/#copy" rel="nofollow noreferrer">here</a>.</p>
  
  <p><strong>Question:</strong>
  Are there still security risks if the files and directories are owned by root but the running process is owned by a non-root user, like <code>www-data</code>? For example, with <a href="https://github.com/docker-library/php/blob/4cfa24e13f603a7e84445ae114711911cc72f0b6/7.1/fpm/Dockerfile" rel="nofollow noreferrer">php-fpm</a>:</p>
  
  <pre><code>root@7bf71145c18c:/var/www/html# ls -l
  total 1220
  -rw-rw-r-- 1 root root    5931 May 10 12:28 index.php
  drwxrwxr-x 3 root root    4096 May 10 12:28 logs
  -rw-rw-r-- 1 root root      28 May 10 12:28 robots.txt
  
  root@7bf71145c18c:/var/www/html# ps -ef
  UID        PID  PPID  C STIME TTY          TIME CMD
  root         1     0  0 14:14 ?        00:00:00 php-fpm: master process (/usr/lo
  www-data     5     1  0 14:14 ?        00:00:00 php-fpm: pool www
  www-data     6     1  0 14:14 ?        00:00:00 php-fpm: pool www
  root         7     0  0 14:19 ?        00:00:00 bash
  root        12     7  0 14:19 ?        00:00:00 ps -ef
  </code></pre>
  
  <p>If so, I'm wondering how (and where) to correctly <code>chown</code> and <code>chmod</code> my files. From my research, this seems less straightforward if you're using docker-compose, which I am - I'm using both a docker-compose YAML file (version 3) in conjunction with container-specific Dockerfiles. It seems that when I <code>chown</code> at the end of a container's Dockerfile, the changes don't go into effect - probably because the volume (which is defined in docker-compose.yml) is created afterwards. Here's some snippets of both configurations:</p>
  
  <p><strong>docker-compose.yml:</strong></p>
  
  <pre><code>version: '3'
  services:
    fpm:
      build: ./fpm
      container_name: "fpm"
      volumes:
        - data_volume:/var/www/html
      ports:
        - "9000"
      restart: always
  volumes:
    data_volume:
  </code></pre>
  
  <p><strong>./fpm Dockerfile:</strong></p>
  
  <pre><code>FROM php:7-fpm
  RUN mkdir -p /var/www/html/
  COPY . /var/www/html/
  RUN find /var -exec chown www-data:www-data {} \;
  RUN find /var -type d -exec chmod 755 {} \;
  RUN find /var -type f -exec chmod 644 {} \;
  </code></pre>
  
  <p>With the different docker-compose versions, it's hard to sort through the various web articles, bug fixes, and feature requests surrounding this topic. I'm hoping to get some definitive direction/answers here, geared toward docker-compose version 3.</p>