Dockerfile USER: running processes as non-root

USER sets the user (by name or UID) for all subsequent RUN, CMD, and ENTRYPOINT instructions.

UIDs are the same on the host and in the container, but usernames may map to different UIDs, which can complicate permission setup.

Example:

FROM centos:latest
RUN useradd -ms /bin/bash cloud_user
USER cloud_user

Always include USER in Dockerfiles (or switch users in ENTRYPOINT/CMD scripts). Without it, processes run as root, and a container compromise can grant root on the host.