> ## Documentation Index
> Fetch the complete documentation index at: https://tally.wharflab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# hadolint/DL3002

> Last user should not be root.

Last user should not be root.

| Property | Value |
| - | - |
| Severity | Warning |
| Category | Security |
| Default | Enabled |

## Description

Switching to the root `USER` opens up certain security risks if an attacker gets access to the container. In order to mitigate this, switch back to a
non-privileged user after running the commands you need as root.

## Examples

### Problematic code

```dockerfile theme={null}
FROM busybox
USER root
RUN ...
```

### Correct code

```dockerfile theme={null}
FROM busybox
USER root
RUN ...
USER guest
```

## Reference

* [hadolint/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)


## Related topics

- [tally/stateful-root-runtime](/rules/tally/stateful-root-runtime.md)
- [tally/user-created-but-never-used](/rules/tally/user-created-but-never-used.md)
- [Hadolint rules](/rules/hadolint/overview.md)
- [hadolint/DL3020](/rules/hadolint/DL3020.md)
- [hadolint/DL3021](/rules/hadolint/DL3021.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.