# Docker Security Hardening

> Use when hardening Docker containers and images.

- Skill: `loopyluci/docker-security-hardening` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/docker-security-hardening`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/docker-security-hardening/raw
- Safety review: pending (external: skill-scanner PASS, skillspector WARNING)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/docker-security-hardening

---

# Docker Security Hardening

Hardening containers and images.

## Non-Root User
```dockerfile
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
COPY --chown=appuser:appgroup . /app
```

## Read-Only Rootfs
```powershell
docker run --read-only --tmpfs /tmp --tmpfs /var/run myapp
```

## Drop Capabilities
```powershell
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE myapp
```

## Image Scanning
```powershell
docker scout quickview myapp:latest
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\
    aquasec/trivy image myapp:latest
```

## Secrets (don't bake in)
```powershell
docker run --secret id=db_pass,src=./secrets/db_pass.txt myapp
```

## Dockerfile
```dockerfile
RUN apt-get update && apt-get install -y --no-install-recommends pkg \\
    && rm -rf /var/lib/apt/lists/*
FROM node:20.11.0-alpine3.18    # pin versions, not "latest"
```

## Pitfalls
- "latest" tags change -- pin versions
- Env vars with secrets leak to docker history -- use --secret
- --privileged defeats all security -- avoid