Thomas,
if I understood correctly, you're runnig freeipa-container, right?
If you are, the --user parameter should receive a user that is already
created in image.
Also, this is not related to the freeipa-server image specifically, but a
general usage of Docker.
You can check more of it in [1] and [2].
If I misunderstood it, please provide more details/context of it.
[1]
https://docs.docker.com/engine/reference/run/#user
[2]
https://stackoverflow.com/questions/41100333/difference-
between-docker-run-user-and-group-add-parameters