container-security

container-security

Security hardening for containerized workloads at every layer: image build time, runtime configuration, secrets handling, and supply-chain verification. Applied in docker-compose, Kubernetes, or bare Docker.

Non-Root User (Always)

Running as root inside a container is a container escape waiting to happen. Enforce non-root at image build time.

# Create a locked-down user — no home dir (unless needed), no shell, known UID
RUN addgroup --system --gid 1001 appgroup && \
    adduser  --system --uid 1001 --ingroup appgroup --no-create-home --shell /sbin/nologin appuser

WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser

# For distroless images — use numeric UID (no user database available)
FROM gcr.io/distroless/python3-debian12:nonroot
# The :nonroot tag already runs as uid 65532

# Verify the running container user
docker inspect myapp_api_1 --format '{{.Config.User}}'
# Or from inside:
docker exec myapp_api_1 id

Read-Only Root Filesystem

Prevents an attacker from writing malware or backdoors to the container's filesystem after a compromise.

services:
  api:
    image: myapp:latest
    read_only: true
    tmpfs:
      - /tmp:size=50m,mode=1777    # writable scratch, limited size
      - /app/cache:size=100m
    volumes:
      - /opt/uploads:/app/uploads  # explicit writable mount for user uploads

# Test that read_only is enforced
docker exec myapp_api_1 touch /test 2>&1
# Expected: touch: /test: Read-only file system

Capability Dropping

Docker grants containers a permissive set of Linux capabilities by default. Drop all, add back only what's needed.

services:
  api:
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE   # only if binding to port < 1024 (prefer port > 1024)
    security_opt:
      - no-new-privileges:true    # prevents setuid escalation

  # A service that needs nothing at all (most web apps)
  frontend:
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true