What role does user specification play in Dockerfile and why is it necessary?

Specifying a user in a Dockerfile using the USER instruction sets which user will execute subsequent commands and processes inside the container. This is important for security: running applications as root increases risks, as a vulnerability could give an attacker full access to the container. Using a non-privileged user reduces these risks and aligns with the principle of least privilege.

Example:

FROM ubuntu:latest
RUN useradd -m appuser
USER appuser
CMD ["/bin/bash"]

Here, after creating the appuser, all commands will be executed on their behalf.