How to Use sudo Inside a Docker Container

TLDR

Most Docker containers run as root by default, so you usually don't need sudo to run privileged commands. If you want to use sudo (for multi-user images or extra security), you'll need to install it and configure users. This guide shows how, with practical examples and best practices.

Why Isn't sudo Available by Default?

Docker containers are designed to be lightweight and secure. By default, most images run as root, so you can install packages or modify the system without sudo. Many base images (like Alpine, Ubuntu, Debian) don't include sudo to keep images small.

Running as Root (No sudo Needed)

If your container runs as root (the default), just run commands directly:

FROM ubuntu:22.04
RUN apt-get update && apt-get install -y curl
CMD ["bash"]

Inside the container:

# You're already root
apt-get update

Adding sudo to a Container

If you want to use sudo (for example, to switch between users or for development parity), you need to install it and set up users:

FROM ubuntu:22.04
RUN apt-get update && apt-get install -y sudo
RUN useradd -m devuser && echo "devuser ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
USER devuser
CMD ["bash"]

Now, inside the container:

sudo apt-get update

This works just like on a regular Linux system.

When Should You Use sudo in Docker?

• Development images: To mimic a real user environment or test scripts that require sudo.
• Multi-user containers: If your container runs as a non-root user but needs to escalate privileges for some tasks.
• Security best practices: For production, it's better to run as a non-root user and only use sudo when absolutely necessary.

Best Practices

• Avoid running production containers as root unless required.
• Only install sudo if you need it—otherwise, keep images minimal.
• Use the USER directive in your Dockerfile to specify a non-root user.
• For one-off commands, you can override the user at runtime:

docker run -u root my-image whoami

Troubleshooting

• If you see sudo: command not found, install it in your Dockerfile.
• If you get permission errors, check your user and group settings.
• For Alpine images, use apk add sudo instead of apt-get install sudo.

Conclusion

You rarely need sudo in Docker containers, since most run as root by default. If you do need it, install and configure it in your Dockerfile, and use the USER directive for better security. Keep your images minimal and only add what you need for your use case.