tianon/gosu

Health v2 · maintenance only

Adoption not part of the score

5000 stars · 356 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

gosu is a small Go-based CLI tool for switching to another user (setuid/setgid/setgroups) and exec'ing a command, designed as a lightweight replacement for su/sudo in containers. It avoids TTY and signal-forwarding problems by exec'ing the target process so gosu is no longer resident.

Use cases

• drop from root to a non-privileged user in a docker entrypoint
• run a command as another user inside a container without su or sudo
• avoid signal and tty forwarding issues when switching users
• specify user and group by name or uid/gid when launching a process
• run container applications as unprivileged users

When to choose

• you need to step down from root to a normal user during container startup
• su or sudo cause signal or TTY problems in your container entrypoint
• you want a tiny static binary with no configuration files

When to avoid

• you need general-purpose privilege escalation or sudo policy features
• you want to use gosu to step up to root, which may be vulnerable (e.g. CVE-2016-2779)
• you are not on Linux

Facets

cli-tool · maturity stable

security developer-tools cli developer-tools cli setuid docker-entrypoint user-switching container-startup drop-privileges containers devops linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="tianon/gosu")