# End the Dockerfile on a user that is not root

The last USER line wins. If that line is root or 0, or if the Dockerfile has no USER, the check flags it.

Published 2026-10-26.

## The last USER is the one that runs

The container-runs-as-root check reads the Dockerfile text. It flags a last `USER` of `root` or `0`, or a file with no `USER` instruction. It does not build the image. A comment is not a `USER` line. A name that shows up only in `CMD` is not one either. No finding does not prove the container that is running is unprivileged.

Each Docker stage has its own user, and the last stage is the image you ship. A `USER` in an earlier stage does not apply to the last stage. If the last stage has no `USER` line, say so in review. The check is written for the last `USER` in the file, or for no `USER` at all.

## Name a user the image already has

End the last stage on a user the image already has: `USER node`, `USER nginx`, or a user you created with `useradd` in that file. That is the check's suggested next step. `USER 1000` is not this finding. The check does not build the image, so a passing file still does not prove that user exists when the container starts. If the process must bind to port 80, move it above 1024 or name the capability you mean. `USER root` is not the fix for a low port.

Paste the Dockerfile and ask for the last `USER` line. If there is no `USER` line, that is the finding.

## Related

- [Container runs as root](https://skaleagents.com/checks/container-runs-as-root)
- [Container privilege review](https://skaleagents.com/resources/container-privilege-review)
- [Set a memory limit](https://skaleagents.com/blog/set-a-memory-limit)