Docker Security Basics
Run containers with least privilege and trusted images.
- docker security
- non-root
- read-only container
- cap-drop
- image scan
Docker Security Basics
Run containers with least privilege and trusted images.
Commands
| Command | What it does |
|---|---|
docker run --read-only app:v1 | Read-only root filesystem |
docker run --user 1001 app:v1 | Never run as root |
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE app:v1 | Drop Linux capabilities |
docker scout cves app:v1 | Scan image vulnerabilities |
docker run --security-opt no-new-privileges app:v1 | Block privilege escalation |
Example
docker run -d --user 1001 --read-only --cap-drop ALL --name api app:v1
docker scout cves app:v1 | head -30FAQ
Why not run as root?
A container breakout as root means host root; fixed UIDs plus dropped caps contain most escapes.
How do I keep images trustworthy?
Pin digests for prod, scan in CI, rebuild monthly for base-image CVE fixes.
Частые вопросы
Why not run as root?
A container breakout as root means host root; fixed UIDs plus dropped caps contain most escapes.
How do I keep images trustworthy?
Pin digests for prod, scan in CI, rebuild monthly for base-image CVE fixes.
Docker
Docker Install and Setup
Verify the Docker engine, configure context, and check versions.
Docker Images
Pull, list, tag, inspect, and remove images confidently.
Docker Containers
Run, list, stop, and clean up containers in daily work.
Docker Run Options
The flags that matter: detach, ports, env, volumes, limits.