security: default to non-privileged chainlink user in Dockerfile

[R-Panic]

Fixes #21005

Summary

Improved Docker security by defaulting to a non-privileged chainlink user instead of root. This follows the principle of least privilege and represents secure-by-default configuration for container deployments.

Changes

Updated both official Chainlink Dockerfiles:

1. core/chainlink.Dockerfile - main production Dockerfile
2. plugins/chainlink.Dockerfile - experimental/testing Dockerfile

Changed default CHAINLINK_USER argument from:

ARG CHAINLINK_USER=root

To:

ARG CHAINLINK_USER=chainlink

Impact

• Security: Containers now run as non-root by default
• Compatibility: Users who need root can still override with --build-arg CHAINLINK_USER=root
• Minimal: No other changes needed - existing logic already handles user creation when CHAINLINK_USER != root

Testing

The existing Dockerfile logic handles this change correctly:

RUN if [ ${CHAINLINK_USER} != root ]; then useradd --uid 14933 --create-home ${CHAINLINK_USER}; fi

When CHAINLINK_USER=chainlink, the container will:

1. Create a new chainlink user with UID 14933
2. Switch to that user via USER ${CHAINLINK_USER}
3. Set appropriate working directory and environment variables

Security Rationale

Running containers as root by default violates security best practices:

• Privilege escalation: Root processes can exploit container escape vulnerabilities
• Host filesystem access: Root can potentially access host resources
• Kernel vulnerabilities: Root can exploit kernel bugs more easily
• Industry standard: Most production containers run as non-root users

[Moses-main]

Hi team,

I'll update the Dockerfile to use a non-privileged chainlink user for better security. This follows security best practices.

Please assign!

[erikburt]

The official images that we publish run as non-root, as we pass an appropriate parameter for the CHAINLINK_USER arg to the docker build context.

For example:

chainlink/.github/workflows/build-publish.yml

Lines 106 to 107 in 503492d

	docker-build-args: |
	CHAINLINK_USER=chainlink