The container that ran as root because of one chown

A Dockerfile that switched to a non-root user, then switched back for one directory permission and never switched forward again.

USER www-data
COPY --chown=www-data:www-data . /app

# ...forty lines later, added in 2021
USER root
RUN chown -R www-data:www-data /app/storage

# and no USER after it. every container since has run as root.

# the fix, which needed no USER switch at all
RUN --mount=type=bind,source=.,target=/src 
    install -d -o www-data -g www-data /app/storage

The line that switched to root was correct in isolation and the missing line after it is invisible in review, because a Dockerfile has no scoping — USER is a mode that persists to the end of the file. A test that runs id in the built image and asserts the uid is four lines of CI and catches every future instance, which is a better answer than reviewing carefully.