Container UID collisions
Static versus dynamic allocation, and what that means across base images.
The mechanism
Debian allocates package users dynamically in 100-999. Alpine allocates statically, including inside that same range. A given number in this band is therefore predictable on Alpine and system-dependent on Debian.
Evidence
- Debian Policy ยง 9.2.2: 100-999 is "Dynamically allocated system users and groups".
- alpine-baselayout allocates statically in the same band: uid 123 ntp, uid 405 guest, gid 300 abuild, gid 406 utmp, gid 999 ping.
- Neither Debian nor Alpine allocates uid 999 in the source package. On Alpine, 999 is assigned to the group ping.
Correction, 2026-08-07. The earlier claim -- that the distributions assign the same UID to different system users, and that this explains --user 999 -- is not supported by the sources. Conflicts do exist (see uid-gid.json), but they lie in 0-99, not at 999.
Sources
| Distribution | Source package | Package version | Commit | Read from source |
|---|---|---|---|---|
| Debian | base-passwd | 3.6.8 | a080557e1d59 | 2026-08-07 |
| Alpine Linux | alpine-baselayout | 3.7.2 | a9c597c5cee0 | 2026-08-07 |