EX200 Manage containers Practice Question
A team wants to run a container as a non-root user inside the container for security. Which instruction should be included in the Containerfile?
⚠ Common exam trap
It's easy for candidates to confuse creating a user (RUN useradd) with actually running as that user, forgetting that the USER instruction is required to switch the runtime context, or they invent non-existent instructions like PODMAN_USER.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
USER
The USER instruction in a Containerfile (Dockerfile) sets the user name or UID to use when running the container and for any subsequent RUN, CMD, or ENTRYPOINT instructions. By default, containers run as root (UID 0), which poses a security risk. Using USER to switch to a non-root user (e.g., USER 1001) ensures the container process runs with reduced privileges, aligning with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
USER
Why this is correct
The USER instruction is the standard Containerfile directive that sets the active user for subsequent instructions, including the final CMD/ENTRYPOINT runtime process. By specifying a non-root user or numeric UID (e.g., USER 1000), the container runs with least privilege. This is the only option here that directly changes the identity of the running container process.
- ✗
PODMAN_USER
Why it's wrong here
PODMAN_USER is not a recognized instruction in Containerfile or Dockerfile syntax. Podman is a container engine, not a build directive, so this line would cause a build error rather than set a runtime user. The correct approach is to use USER after creating the desired non-root account, not a made-up instruction.
- ✗
ENV USER
Why it's wrong here
ENV USER=1000 merely defines an environment variable named USER in the container's runtime environment. It does not alter the Linux user ID, effective capabilities, or UID/GID of the running process, which will still default to root if no USER instruction exists. Some images use USER as a conventional variable to configure application behavior, but it has no privilege-limiting effect.
- ✗
RUN useradd
Why it's wrong here
RUN useradd appuser creates a new user record in the image's /etc/passwd and /etc/shadow files, but it leaves the default effective user as root for every subsequent instruction. The USER directive is still required to switch to that account before the container starts. Without that switch, creating a user alone offers no security benefit for the running container.
Go deeper
Related to this question
About these practice questions
Courseiva writes every EX200 question from scratch — 127 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.