We have explained why we need to run our service as a limited user and how we created the user for it, but now is the time to permanently switch the context to pythonsrv. Using USER pythonsrv, any further commands will be executed as pythonsrv user, including the container's CMD executable command, which is exactly what we want. Just like WORKDIR, this directive can be used multiple times in a Dockerfile, but for our purposes, there is no need to do the rest of the configuration as non-root. Generally, it is a good practice to keep this layer statement as high as possible in the Dockerfile since it is very unlikely that it will change and would be unlikely to break cache. However, for this example, we can't move it higher as our previous command uses chown, which requires root privileges.