Security — Cheat Sheet

Container security spans image hardening, runtime restrictions, secret management, and network policies. A misconfigured container can expose the host kernel to attack.

• ✓Drop all Linux capabilities with --cap-drop=ALL and add back only what is needed.
• ✓--read-only makes the root filesystem immutable — attackers cannot write malware.
• ✓Never use ENV for secrets in production — they are visible in docker inspect and to all processes.
• ✓Never use --privileged mode — it gives container full host kernel access.
• ✓Never mount the Docker socket into a container — it enables full host Docker control.
• ✓Use Trivy or Docker Scout in CI to catch CVEs before pushing images to production.

# Drop all capabilities, add back only net_bind_service (port <1024)

docker run \

  --cap-drop=ALL \

  --cap-add=NET_BIND_SERVICE \

  --read-only \                    # read-only root filesystem

  --tmpfs /tmp \                   # writable temp dir in memory only

  --security-opt no-new-privileges \  # prevent setuid escalation

  --user 1000:1000 \               # non-root UID:GID

  nginx:alpine



# In docker-compose.yml:

services:

  api:

    cap_drop:

      - ALL

    cap_add:

      - NET_BIND_SERVICE

    read_only: true

    tmpfs:

      - /tmp

    security_opt:

      - no-new-privileges:true

    user: "1000:1000"