It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the host (eg the answer to this question), and escaping a container is well documented.
The particular infrastructure in question is an API service hosted in AWS in which the server application executes as the root user, as provided in the servers getting started guide. The only information available inside this container is the server application and access credentials to our DB - which the server application requires. While access to the access credentials is a risk the server application requires access to these credentials even if it ran as a regular user, and I can't see that running the server as root increases this risk.
My question boils down to:
- Given that this service is hosted on AWS and is ephemeral, how can I quantify the security risk caused by an external facing application running as root?