ContainerCodeExecutor docs say non-root, but the container runs as the image's default user (root for python:3.11-slim)

The code executor guide says:
"ContainerCodeExecutor starts a Docker container as a non-root user, with the network off and Linux capabilities dropped."

adk-python/docs/guides/code_executors/code_executor/index.md

Lines 199 to 201 in 12c7bed

    
           `ContainerCodeExecutor` starts a Docker container as a non-root user, with the 
        
           network off and Linux capabilities dropped. If you are moving off 
        
           `UnsafeLocalCodeExecutor`, this is the shortest step that puts a real boundary

The network and capability hardening is there, but containers.run doesn't set user=, and neither do the exec_run calls:

adk-python/src/google/adk/code_executors/container_code_executor.py

Lines 329 to 340 in 12c7bed

    
           self._container = self._client.containers.run( 
        
               image=self.image, 
        
               detach=True, 
        
               tty=True, 
        
               # Harden the sandbox for untrusted, model-generated code: no network 
        
               # (blocks metadata/SSRF/exfil), drop all Linux capabilities, and 
        
               # forbid privilege escalation. Networking can be re-enabled via 
        
               # `network_enabled=True` when the executed code is trusted. 
        
               network_disabled=not self.network_enabled, 
        
               cap_drop=['ALL'], 
        
               security_opt=['no-new-privileges'], 
        
           )

So the model's code runs as whatever user the image defaults to. For the image in the doc's own example (python:3.11-slim) that's root:

adk-python/docs/guides/code_executors/code_executor/index.md

Line 212 in 12c7bed

image="python:3.11-slim",

#6074 added the network and capability hardening; the user part seems to be the piece that didn't land. Maybe it's just the docs, but since this is described as the step that "puts a real boundary" between model code and the host, passing e.g. user="65534:65534" (or making it configurable) seems like the better fix than editing the sentence.

Found while testing a docs-vs-code checker I'm building (Elliot), then verified by hand.

May I send a small guide correction so it no longer promises a non-root user? The container and exec calls leave user unset, so the guide should describe the image's configured user. I would leave runtime user selection separate, since forcing a UID could affect custom images.

Thanks for confirming! I’ll open the docs PR myself today, keeping runtime user selection out of scope as you suggest.

…

On Sat, Oct 24, 2026 at 9:24 PM Samecho ***@***.***> wrote: *Samecho* left a comment (google/adk-python#7712) <#7712 (comment)> May I send a small guide correction so it no longer promises a non-root user? The container and exec calls leave user unset, so the guide should describe the image's configured user. I would leave runtime user selection separate, since forcing a UID could affect custom images. — Reply to this email directly, view it on GitHub <#7712?email_source=notifications&email_token=BXT3IQMHN7D4VG2YRX6PDM35VT6XVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZYHA2TCMBRHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6388510194>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BXT3IQPKNNWTRGCWX6WENBD5VT6XVAVCNFSNUABFKJSXA33TNF2G64TZHM4TKOBYGMYDMNJZHNEXG43VMU5TMMBRGYZTCOBRHAZ2C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BXT3IQLTZWDUSVPJKYW3MH35VT6XVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZYHA2TCMBRHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BXT3IQK4RDVB2RHH3BQAXZT5VT6XVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZYHA2TCMBRHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

docs: ContainerCodeExecutor runs as the image's user, not non-root

Navigation Menu

Repository navigation

ContainerCodeExecutor docs say non-root, but the container runs as the image's default user (root for python:3.11-slim) #7712

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	`ContainerCodeExecutor` starts a Docker container as a non-root user, with the
	network off and Linux capabilities dropped. If you are moving off
	`UnsafeLocalCodeExecutor`, this is the shortest step that puts a real boundary

	self._container = self._client.containers.run(
	image=self.image,
	detach=True,
	tty=True,
	# Harden the sandbox for untrusted, model-generated code: no network
	# (blocks metadata/SSRF/exfil), drop all Linux capabilities, and
	# forbid privilege escalation. Networking can be re-enabled via
	# `network_enabled=True` when the executed code is trusted.
	network_disabled=not self.network_enabled,
	cap_drop=['ALL'],
	security_opt=['no-new-privileges'],
	)

ContainerCodeExecutor docs say non-root, but the container runs as the image's default user (root for python:3.11-slim) #7712

Description

Activity

Samecho commented on Oct 24, 2026

EmanueleCell4 commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions