# AWX docker containers running as non-root

**URL:** <https://forum.ansible.com/t/awx-docker-containers-running-as-non-root/29701>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [February 18, 2019, 9:46pm UTC](https://forum.ansible.com/t/awx-docker-containers-running-as-non-root/29701 "2019-02-18T21:46:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aeiffel970](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@aeiffel970](https://forum.ansible.com/u/aeiffel970)\
**Post date:** [February 18, 2019, 9:46pm UTC](https://forum.ansible.com/t/awx-docker-containers-running-as-non-root/29701/1 "2019-02-18T21:46:16Z")

</div>

Having followed the docker install instructions, I notice that although the postgres and memcached containers are running as non-root, the awx\_web and awx\_task containers are running as root.

I am pretty new to docker but my understanding is that following the principle of least privilege, it is not desirable to run containers as root.

How would I go about changing this so that awx\_task and awx\_web containers run as specific non-root users? Is this something that I can configure in the inventory?

I tried creating a user awx\_web in the host, and then edited the awx installer file “standalone.yml”, changing “user: root” to “user: awx\_web”, and then ran install.yml, but I get:

TASK [local\_docker : Activate AWX Web Container] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
[WARNING]: Non-string value found for env option. Ambiguous env options should be wrapped in quotes to avoid YAML parsing. This will become an error in Ansible 2.8. Key:  
DATABASE\_PORT; value will be treated as: 5432

fatal: [localhost]: FAILED! =\> {“changed”: false, “msg”: “Error starting container 1fee59dbdc78e950b68f147278e62dc73f138f020b7861ddbe2593ca7de51f7e: 500 Server Error: Internal Server Error ("linux spec user: unable to find user awx\_web: no matching entries in passwd file")”}

---

<div class="post-metadata">

**Author:** ![Uriel](https://avatars.discourse-cdn.com/v4/letter/u/53a042/32.png) [@Uriel](https://forum.ansible.com/u/Uriel)\
**Post date:** [February 19, 2019, 5:32pm UTC](https://forum.ansible.com/t/awx-docker-containers-running-as-non-root/29701/2 "2019-02-19T17:32:18Z")

</div>

It seems like the container doesn’t know of any user “awx-web”. You can try adding the user to the container (you’d have to modify the Dockerfile and rebuild the images) as in [https://stackoverflow.com/questions/27701930/add-user-to-docker-container](https://stackoverflow.com/questions/27701930/add-user-to-docker-container) and then changing the user in the standalone.yml file.

But I don’t know if this will break anything internally because it is owned by root but is being run as another user.

---

<div class="post-metadata">

**Author:** ![Darkhan](https://avatars.discourse-cdn.com/v4/letter/d/34f0e0/32.png) [@Darkhan](https://forum.ansible.com/u/Darkhan)\
**Post date:** [February 20, 2019, 3:50pm UTC](https://forum.ansible.com/t/awx-docker-containers-running-as-non-root/29701/3 "2019-02-20T15:50:06Z")

</div>

Can you post your inventory file? With what user did you run the install.yml playbook? Is that user in the docker group?