nonroot

Nonroot refers to an account or process that does not possess root privileges (UID 0) on a Unix-like system. The root user has unrestricted access to the system, whereas nonroot users are restricted by file permissions and system policies. In practice, most day-to-day tasks run as nonroot to limit potential damage from mistakes or exploitation.

Principle of least privilege guides its use. Running services and users as nonroot reduces the risk of privilege escalation, helps isolate processes, and minimizes the impact of compromised credentials. In container environments, running containers as nonroot is common practice to improve security; some runtimes also offer rootless modes.

Implementation: On Linux, create a nonroot user with commands such as: useradd -m -s /bin/bash alice; passwd alice; and grant sudo access if elevated privileges are occasionally required. For applications that must bind to low-number ports or access sensitive resources, alternative mechanisms such as capabilities or dedicated groups are used. In containers, a Dockerfile might specify USER 1000 to run as a nonroot user; similarly, Podman supports rootless containers.

Security considerations: When operating as nonroot, ensure correct file permissions, appropriate group memberships, and use of security frameworks like SELinux or AppArmor. Some tasks still require root access, so privileged escalation should be controlled and audited. Rootless container setups are an example of end-to-end nonroot operation.

See also root, sudo, capabilities, SELinux, AppArmor.