ps aux showed a process running as user ollama. A process I never started, running as a user tied to the Ollama service. My first thought was the obvious one: Ollama got compromised and someone is running a miner on my box.

Three days later the "miner" turned out to be a Postgres container.

What happened: Docker containers run their processes with an internal numeric UID. That UID is chosen inside the image — Postgres, for example, runs as a specific numeric user. On the host, ps (and top, and everything else that reads /proc) does a lookup of that numeric UID against /etc/passwd to print a name.

The Postgres image's internal UID happened to collide with the numeric UID of the ollama service account on my host. So every process inside the container was displayed as ollama — the container wasn't using the ollama user at all, my host just resolved the number to a familiar name and I connected the dots wrong.

The tell: the "miner" process's command line was a normal Postgres startup, its parent was containerd, and docker top <container> showed the same PID running fine inside the container. A real miner would have an unusual binary path and a parent chain pointing somewhere suspicious.

Ways to actually verify instead of trusting the name column:

  • ps -o uid,user,comm,args — look at the raw UID number, not just the resolved name.
  • docker top <container> — shows what's running inside the container.
  • Check /etc/passwd for UID collisions: awk -F: '{print $3}' /etc/passwd | sort | uniq -d.

The lesson I took away: the username in ps is a convenience label resolved from a number. When the number belongs to a container, the label can be misleading. Before you assume a breach, confirm the UID maps to what you think it maps to.

Full write-up: https://igornews.com/2026/11/11/miner-in-ps-wasnt-ollama-uid-collision/