Docker Security Hardening

Containers are isolated, but the host system needs protection.

1. Do Not Run as Root

Avoid running containers as the root user. Create a dedicated user in your Dockerfile.

FROM node:20-alpine
WORKDIR /app
COPY . .
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
CMD ["npm", "start"]

2. Limit Resources

Prevent Denial of Service (DoS) attacks by limiting memory and CPU.

version: '3'
services:
  web:
    image: nginx
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 512M

3. Image Scanning

Regularly scan your images for vulnerabilities using tools like Trivy or Docker Scan.

docker scan my-image:latest

4. Rootless Docker

Consider running the Docker daemon in rootless mode to mitigate potential privilege escalation attacks.