gosu is a lightweight privilege-dropping tool that simplifies running applications as a specific non-root user without the complexity and signal-handling issues of su and sudo.
The problem gosu solves is the awkward TTY and signal-forwarding behavior of traditional privilege-switching tools. Rather than forking and managing a subprocess, gosu uses the same user and group processing code that Docker's libcontainer uses, then directly execs the target process. Once the exec happens, gosu is no longer resident in the process lifecycle, leaving signal handling and TTY management to the invoking and invoked processes where they naturally belong.
gosu is designed specifically for stepping down from root to a non-privileged user during container startup, typically in a Dockerfile ENTRYPOINT. The tool achieves exact parity with Docker's --user flag because it reuses Docker's own user and group processing logic. The README names several alternatives: setpriv from util-linux provides similar behavior on newer systems, chroot with --userspec offers comparable functionality, and su-exec is a minimal C rewrite available in Alpine Linux repositories that produces a smaller binary. The README explicitly warns that uses beyond the core container startup case could suffer from privilege-escalation vulnerabilities and recommends reviewing the discussion around CVE-2016-2779 for context.
The project maintains a test suite in Dockerfile.test-alpine and test.sh that covers edge cases in user and group handling. Development activity shows ongoing maintenance with attention to security considerations and compatibility across different Linux distributions and architectures.
