nobody user was originally used for NFS. However people started using it to run daemons that did not need to run as root. This was fine when used by just one daemon, but it is no longer recommended when multiple daemons are running as that user. Linux only provides inter-user isolation, not intra-user isolation, meaning user X and user Y cannot tamper with each other's processes, but one process running as user X can tamper with another process running as user X. If Docker is running as the this user, anything running as the same user will be able to compromise it, for example by attaching debuggers and modifying memory via
ptrace() and similar syscalls, sending signals via
fcntl(), or even changing resource limits via
The recommended solution is to run an unprivileged daemon under its own user or group.