如何检查Docker镜像是否存在以root执行的命令（OpenShift场景）

Great question! Since you're working with OpenShift which enforces non-root container execution, checking for root-run commands in images is super important. Let's break this down into two scenarios: your custom images (where you have the Dockerfile) and arbitrary images (where you don't have the source Dockerfile).

一、检查自定义Docker镜像（有Dockerfile的情况） #

This is the easiest scenario because you have direct access to the build definition:

• Check the USER directive: By default, all Docker commands run as root if no USER is specified. If you see USER root (or no USER line at all), all subsequent RUN, CMD, and ENTRYPOINT commands run as root. If you've switched to a non-root user with USER <non-root-user>, commands after that line run as that user—but watch out for workarounds like RUN su root -c "some command" or RUN sudo some-command that switch back to root.
• Quick scan with grep: You can automate this check with a simple grep command to flag risky lines:

  grep -E 'USER root|su root|sudo' Dockerfile
  

二、检查任意Docker镜像（无Dockerfile的情况） #

When you don't have the Dockerfile, you need to inspect the image's built-in metadata and history:

1. Inspect the image build history #

The docker history command shows every step used to build the image, including the user that ran each RUN command. Use the --no-trunc flag to see full command details:

docker history --no-trunc <image-name-or-id>

Look at the USER column in the output. If it shows root (or is empty, which defaults to root), the corresponding RUN command executed as root.

2. Check the default runtime user #

Use docker inspect to see the image's configured default user for CMD/ENTRYPOINT:

docker inspect --format='{{.Config.User}}' <image-name-or-id>

• An empty output or root means the container will default to running as root unless overridden.
• Note: This only checks the runtime user—build-time RUN commands might still have run as root, so always pair this with the docker history check.

3. Test runtime user with a temporary container #

Spin up a one-off container to run a command that shows the current user:

docker run --rm <image-name-or-id> whoami

If the output is root, the image defaults to running as root. Again, this only covers runtime, not build-time commands.

4. Advanced: Use image analysis tools #

For deeper inspection (especially for multiple images), you can use open-source tools like dive—it visualizes image layers and lets you check the user context for each layer's commands without needing the Dockerfile.

Key Notes for OpenShift #

Even if an image doesn't run commands as root, make sure to check file permissions too! OpenShift runs containers with a random non-root UID, so files/directories in the image need to be readable/writable by non-root users (avoid strict root:root permissions with no world-read access).

内容的提问来源于stack exchange，提问作者heldt