Should stack run image have a different user id to build image?

[nokome]

Hi 👋🏽 .

I was looking at the spec for stacks https://github.com/buildpacks/spec/blob/HEAD/platform.md#run-image and noted:

The platform SHOULD ensure that...The image config's User field is set to a user with a DIFFERENT user UID/SID as the build image.

whereas https://buildpacks.io/docs/operator-guide/create-a-stack/#setting-the-user says

Lastly to finish off our build image, we need to set the image’s USER to the user with CNB_USER_ID [ the same as used in run image]

Any recommendations on the right approach? Seems like following the spec and using a different id is probably the safest.

[samj1912]

The spec is indeed correct. There was an RFC that changed the recommendation in https://github.com/buildpacks/rfcs/blob/main/text/0085-run-uid.md. I believe the docs have not been updated to reflect this.

[nokome]

Thanks @samj1912 🙏🏽 , that was exactly the thing I was looking for (motivation for change).