diff --git a/cassandra/Dockerfile b/cassandra/Dockerfile
index 4ca9656..22c70bf 100644
--- a/cassandra/Dockerfile
+++ b/cassandra/Dockerfile
@@ -15,7 +15,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=cassandra,python2-basic,which --no-boot-update \
+    --bundles=cassandra,python2-basic,which,su-exec --no-boot-update \
     && rm -rf /install_root/var/lib/swupd/*
 
 # For some Host OS configuration with redirect_dir on,
diff --git a/cassandra/docker-entrypoint.sh b/cassandra/docker-entrypoint.sh
index 5952a87..8bdf5e6 100755
--- a/cassandra/docker-entrypoint.sh
+++ b/cassandra/docker-entrypoint.sh
@@ -9,7 +9,7 @@ fi
 
 # allow the container to be started with `--user`
 if [ "$1" = 'cassandra' -a "$(id -u)" = '0' ]; then
-	exec su cassandra -s /bin/bash -c "$BASH_SOURCE" "$@"
+    exec su-exec cassandra "$BASH_SOURCE" "$@"
 fi
 
 _ip_address() {
diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile
index 85c4091..8c46402 100644
--- a/elasticsearch/Dockerfile
+++ b/elasticsearch/Dockerfile
@@ -17,7 +17,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=elasticsearch --no-boot-update
+    --bundles=elasticsearch,su-exec --no-boot-update
 
 # For some Host OS configuration with redirect_dir on,
 # extra data are saved on the upper layer when the same
diff --git a/elasticsearch/docker-entrypoint.sh b/elasticsearch/docker-entrypoint.sh
index eb1a8bf..e28d4b6 100755
--- a/elasticsearch/docker-entrypoint.sh
+++ b/elasticsearch/docker-entrypoint.sh
@@ -20,8 +20,7 @@ if [ "$1" = 'elasticsearch' -a "$(id -u)" = '0' ]; then
 		chown -R elasticsearch:elasticsearch "$path"
 	done
 	
-	# use tmp file to avoid multiple parameters issue on su -c
-	echo "elasticsearch  -s /bin/bash -c \"$0 $@\"" | xargs su
+    set -- su-exec elasticsearch "$@"
 fi
 
 # As argument is not related to elasticsearch,
diff --git a/mariadb/Dockerfile b/mariadb/Dockerfile
index 41eb5ca..79476ba 100644
--- a/mariadb/Dockerfile
+++ b/mariadb/Dockerfile
@@ -17,7 +17,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=mariadb --no-boot-update \
+    --bundles=mariadb,su-exec --no-boot-update \
     && rm -rf /install_root/var/lib/swupd/*
 
 # For some Host OS configuration with redirect_dir on,
diff --git a/mariadb/docker-entrypoint.sh b/mariadb/docker-entrypoint.sh
index d454fdf..59d0afb 100644
--- a/mariadb/docker-entrypoint.sh
+++ b/mariadb/docker-entrypoint.sh
@@ -70,7 +70,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" -a "$(id -u)" = '0' ]; then
 	DATADIR="$(_get_config 'datadir' "$@")"
 	mkdir -p "$DATADIR"
 	find "$DATADIR" \! -user mysql -exec chown mysql '{}' +
-	echo "mysql -s /bin/bash -c \"$0 $@\"" | xargs su
+    exec su-exec mysql "$BASH_SOURCE" "$@"
 fi
 
 if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
diff --git a/memcached/Dockerfile b/memcached/Dockerfile
index d8a843d..96213bc 100644
--- a/memcached/Dockerfile
+++ b/memcached/Dockerfile
@@ -15,7 +15,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=memcached --no-boot-update \
+    --bundles=memcached,su-exec --no-boot-update \
     && rm -rf /install_root/var/lib/swupd/*
 
 # For some Host OS configuration with redirect_dir on,
diff --git a/memcached/docker-entrypoint.sh b/memcached/docker-entrypoint.sh
index 4712a29..76480d1 100644
--- a/memcached/docker-entrypoint.sh
+++ b/memcached/docker-entrypoint.sh
@@ -7,7 +7,7 @@ if [ "${1#-}" != "$1" ]; then
 fi
 
 if [ "$1" = 'memcached' -a "$(id -u)" = '0' ]; then
-        echo "memcached -s /bin/bash -c \"$0 $@\"" | xargs su
+    exec su-exec memcached "$BASH_SOURCE" "$@"
 fi
 
 exec "$@"
diff --git a/postgres/Dockerfile b/postgres/Dockerfile
index 955176a..21fb1da 100644
--- a/postgres/Dockerfile
+++ b/postgres/Dockerfile
@@ -17,7 +17,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=postgresql --no-boot-update
+    --bundles=postgresql,su-exec --no-boot-update
 
 # For some Host OS configuration with redirect_dir on,
 # extra data are saved on the upper layer when the same
diff --git a/postgres/bootstrap.sh b/postgres/bootstrap.sh
index aa41756..024fe80 100755
--- a/postgres/bootstrap.sh
+++ b/postgres/bootstrap.sh
@@ -51,7 +51,7 @@ if [ "$1" = 'postgres' ] && [ "$(id -u)" = '0' ]; then
 	fi
         sed -i "s|#listen_addresses.*|listen_addresses = '*'|" /usr/share/postgresql/postgresql.conf.sample
 
-	exec su postgres -s /bin/bash -c "$BASH_SOURCE $@"
+    exec su-exec postgres "$BASH_SOURCE" "$@"
 fi
 
 if [ "$1" = 'postgres' ]; then
diff --git a/rabbitmq/Dockerfile b/rabbitmq/Dockerfile
index 1e25b3c..bd8a7ae 100644
--- a/rabbitmq/Dockerfile
+++ b/rabbitmq/Dockerfile
@@ -17,7 +17,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=os-core-update,rabbitmq-server --no-boot-update
+    --bundles=os-core-update,rabbitmq-server,su-exec --no-boot-update
 
 # For some Host OS configuration with redirect_dir on,
 # extra data are saved on the upper layer when the same
diff --git a/rabbitmq/docker-entrypoint.sh b/rabbitmq/docker-entrypoint.sh
index d8cbb0d..1befe14 100755
--- a/rabbitmq/docker-entrypoint.sh
+++ b/rabbitmq/docker-entrypoint.sh
@@ -90,7 +90,7 @@ if [[ "$1" == rabbitmq* ]] && [ "$(id -u)" = '0' ]; then
 		[ -n "$val" ] || continue
 		case "$conf" in
 			*_ssl_*file | ssl_*file )
-				if [ -f "$val" ] && ! echo "rabbitmq -s /bin/bash test -r \"$val\"" | xargs su; then
+				if [ -f "$val" ] && ! su-exec rabbitmq test -r "$val"; then
 					newFile="/tmp/rabbitmq-ssl/$conf.pem"
 					echo >&2
 					echo >&2 "WARNING: '$val' ($var) is not readable by rabbitmq ($(id rabbitmq)); copying to '$newFile'"
@@ -108,7 +108,7 @@ if [[ "$1" == rabbitmq* ]] && [ "$(id -u)" = '0' ]; then
 		find /var/lib/rabbitmq \! -user rabbitmq -exec chown rabbitmq '{}' +
 	fi
 
-	exec echo "rabbitmq -s /bin/bash \"$BASH_SOURCE\" \"$@\"" | xargs su
+    exec su-exec rabbitmq "$BASH_SOURCE" "$@"
 fi
 
 haveConfig=
diff --git a/redis/Dockerfile b/redis/Dockerfile
index bd1e6e7..9b4c276 100644
--- a/redis/Dockerfile
+++ b/redis/Dockerfile
@@ -15,7 +15,7 @@ RUN source /os-release && \
     mkdir /install_root \
     && swupd os-install -V ${VERSION_ID} \
     --path /install_root --statedir /swupd-state \
-    --bundles=redis-native,findutils --no-boot-update \
+    --bundles=redis-native,findutils,su-exec --no-boot-update \
     && rm -rf /install_root/var/lib/swupd/*
 
 # For some Host OS configuration with redirect_dir on,
diff --git a/redis/docker-entrypoint.sh b/redis/docker-entrypoint.sh
index f2cf5e7..469bf1b 100644
--- a/redis/docker-entrypoint.sh
+++ b/redis/docker-entrypoint.sh
@@ -9,7 +9,7 @@ fi
 
 # change to redis user to run
 if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then
-    echo "redis -s /bin/bash -c \"$0 $@\"" | xargs su
+    exec su-exec redis "$BASH_SOURCE" "$@"
 fi
 
 exec "$@"