useradd-no-log-init

useradd with a high UID can add gigabytes to a Docker image via /var/log/faillog. Why useradd needs --no-log-init in Dockerfiles.

On this page

RUN useradd -u 100000 appuser can silently add gigabytes to an image. useradd initializes the /var/log/faillog and /var/log/lastlog accounting files, which are indexed by UID — creating a high-UID user makes them enormous sparse files, and Docker's layer format stores sparse files at their full apparent size. This rule flags useradd calls without --no-log-init.

What the rule catches

Dockerfile — a high UID balloons the layer

FROM debian:12-slim
RUN useradd -u 100000 appuser
USER appuser

Scanning this file reports:

⚠ WARN [docker-doctor/useradd-no-log-init]
  RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.

Why it matters

This is a genuine footgun (docker/docker#5419): the Dockerfile looks completely innocent, the build succeeds, and the image is mysteriously huge — nothing in the file hints that a login-accounting quirk from the 1990s is the cause. --no-log-init skips initializing those files, which containers never use anyway (nobody interactively logs into a container through the login subsystem). There is no downside; it's pure insurance.

How to fix it

Pass --no-log-init flag to useradd (e.g., RUN useradd --no-log-init -r -g mygroup myuser).

Dockerfile — accounting files never created

FROM debian:12-slim
RUN useradd --no-log-init -r appuser
USER appuser

-r creates a system account (no home directory, UID from the system range), which is usually what a service container wants. On Alpine the equivalent tool is adduser -S, which doesn't have this problem. Creating a non-root user in the first place is the subject of no-root-user.

Rule details

Rule key — docker-doctor/useradd-no-log-init
Category — Best Practices
Default severity — warning
Applies to — Dockerfiles

Explain this rule from the CLI:

npx @docker-doctor/cli@latest rules explain docker-doctor/useradd-no-log-init

Change its severity — or turn it off — in your config file:

// docker-doctor.config.ts
export default {
  rules: {
    "docker-doctor/useradd-no-log-init": "off",
  },
};

Severity affects the health score: error findings cost more points than warning, and info costs the least.