I don’t understand your question.
The setup of another users is already done in the Dockerfile, you are not required to do anything regarding the user when using the docker image.
No, it doesn’t at all. The unprivileged user is inside the docker container, not on the host machine running the container.
I don’t think I get it right, but your proposition is to replace “USER nobody” in Dockerfile by, let’s say “USER phoenix” ?
And you say this simple change would setup a new user in the Dockerfile, which isn’t “nobody” so he don’t have the permissions which could mess up outside the container. Hence I don’t need to do anything more when using the image ?
In short, just changing the USER (and doing nothing more) close a vulnerability ?
The proposition is already merged into the current Dockerfile in the official docs as per the pull request I linked, but I see now that it was reverted back by what it looks like an accidental change as I mention in my comment.
Please read my report on the issue and the link on it.
Basically the user nobody cannot be trusted to run inside or outside the container any application, neither the root user can also be used to run services, inside or outside a docker container, that are exposed to the internet.