LoopyLuci Docker Security Hardening
Hardening containers and images.
Non-Root User
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
COPY --chown=appuser:appgroup . /app
Read-Only Rootfs
docker run --read-only --tmpfs /tmp --tmpfs /var/run myapp
Drop Capabilities
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE myapp
Image Scanning
docker scout quickview myapp:latest
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\
aquasec/trivy image myapp:latest
Secrets (don't bake in)
docker run --secret id=db_pass,src=./secrets/db_pass.txt myapp
Dockerfile
RUN apt-get update && apt-get install -y --no-install-recommends pkg \\
&& rm -rf /var/lib/apt/lists/*
FROM node:20.11.0-alpine3.18 # pin versions, not "latest"
Pitfalls
- "latest" tags change -- pin versions
- Env vars with secrets leak to docker history -- use --secret
- --privileged defeats all security -- avoid