Container Security

Difficulty: Advanced

Question

What are the top security best practices for Docker images?

Answer

1. **Don't run as root**: Always use a non-privileged USER in the Dockerfile. 2. **Scan for vulnerabilities**: Use tools like Snyk or Docker Scout. 3. **Use small base images**: Alpine or Distroless reduce the attack surface. 4. **Don't store secrets**: Never hardcode API keys or credentials in an image. 5. **Read-only filesystem**: Use `--read-only` flag at runtime to prevent attackers from writing to the disk.

Code examples

Setting a non-root user

FROM node:18-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
WORKDIR /home/appuser/app
# ... rest of Dockerfile

If the container is compromised, the attacker only has access to the 'appuser' permissions, not the whole host.

Key points

• Secrets should be injected via environment variables or secret management systems (Vault, AWS Secrets Manager) at runtime.

Concepts covered

Security, User, Scanning, Read-only