title: Docker using gosu vs USER
body: <p><strong>Docker</strong> kind of always had a <code>USER</code> command to run a process as a specific user, but in general a lot of things had to run as ROOT.</p>
  
  <p>I have seen a lot of images that use an <code>ENTRYPOINT</code> with <code>gosu</code> to de-elevate the process to run.</p>
  
  <p>I'm still a bit confused about the need for <code>gosu</code>. Shouldn't USER be enough? </p>
  
  <p>I know quite a bit has changed in terms of security with Docker 1.10, but I'm still not clear about the recommended way to run a process in a docker container. </p>
  
  <p>Can someone explain when I would use <code>gosu</code> vs. <code>USER</code>? </p>
  
  <p>Thanks</p>
  
  <p>EDIT:</p>
  
  <p>The Docker <a href="https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/" rel="noreferrer">best practice guide</a> is not very clear: It says if the process can run without priviledges, use <code>USER</code>, if you need sudo, you might want to use <code>gosu</code>. 
  That is confusing because one can install all sorts of things as ROOT in the <code>Dockerfile</code>, then create a user and give it proper privileges, then finally switch to that user and run the <code>CMD</code> as that user.
  So why would we need sudo or <code>gosu</code> then?</p>