# Ops Docker Security Hardening

> Professional strategies for securing containerized applications.

- Skill: `jcorpac/ops-docker-security-hardening` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jcorpac/ops-docker-security-hardening`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jcorpac/ops-docker-security-hardening/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: jcorpac (https://skillmd.com/u/jcorpac)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jcorpac/ops-docker-security-hardening

---


# Docker Security Hardening

Containers are not a sandbox by default. You must secure them.

## Non-Root Execution
- **Strategy**: Always create a user (`RUN useradd ...`) and switch to them (`USER appuser`) before the `CMD`.
- **Reason**: Prevents attackers from gaining root access to the host if they compromise the container.

## Secret Management
- **Never use ENV for secrets**: Use Docker Secrets or mount secrets files at runtime.
- **Read-Only**: Mount the root filesystem as read-only whenever possible.

## Best Practices
- **Image Scanning**: Use `docker scout` or `trivy` to identy and fix vulnerabilities.
- **Resource Limits**: Set CPU and Memory limits to prevent DoS attacks on the host.