# Ops Docker Security Hardening > Professional strategies for securing containerized applications. Use when this capability is needed. - Skill: `tomevault-io/ops-docker-security-hardening` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/ops-docker-security-hardening` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/ops-docker-security-hardening/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/ops-docker-security-hardening --- # Docker Security Hardening Containers are not a sandbox by default. You must secure them. ## Non-Root Execution - **Strategy**: Always create a user (`RUN useradd ...`) and switch to them (`USER appuser`) before the `CMD`. - **Reason**: Prevents attackers from gaining root access to the host if they compromise the container. ## Secret Management - **Never use ENV for secrets**: Use Docker Secrets or mount secrets files at runtime. - **Read-Only**: Mount the root filesystem as read-only whenever possible. ## Best Practices - **Image Scanning**: Use `docker scout` or `trivy` to identy and fix vulnerabilities. - **Resource Limits**: Set CPU and Memory limits to prevent DoS attacks on the host. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/jcorpac) — claim your Tome and manage your conversions.