Container Hardening

Container Hardening

Secure container images and runtime configurations.

When to Use This Skill

Use this skill when:

• Building secure container images
• Hardening container deployments
• Meeting container security requirements
• Implementing defense in depth

Dockerfile Security

# Use minimal base image
FROM alpine:3.18

# Don't run as root
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# Copy with specific ownership
COPY --chown=appuser:appgroup . /app

# Remove unnecessary packages
RUN apk del --purge build-dependencies && \
    rm -rf /var/cache/apk/*

# Use non-root user
USER appuser

# Read-only filesystem support
WORKDIR /app

Runtime Security

# Run with security options
docker run -d \
  --read-only \
  --tmpfs /tmp \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --user 1001:1001 \
  myapp:latest

Kubernetes Security Context

apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Image Scanning

# Scan with Trivy
trivy image --severity HIGH,CRITICAL myapp:latest

# Use distroless images
FROM gcr.io/distroless/static-debian11

Best Practices

• Use minimal base images
• Run as non-root user
• Enable read-only filesystem
• Drop all capabilities
• Scan images regularly
• Sign and verify images
• Use secrets management

Related Skills

• container-scanning - Vulnerability scanning
• kubernetes-hardening - K8s security

Container Security Best Practices

Dockerfile Hardening

# Use minimal base image
FROM gcr.io/distroless/base-debian12

# Or Alpine
FROM alpine:3.19

# Non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -D appuser
USER appuser

# Read-only filesystem
# (Set at runtime with --read-only)

# No new privileges
# (Set at runtime with --security-opt=no-new-privileges)

Security Scanning

# Trivy scan
trivy image --severity HIGH,CRITICAL myimage:latest

# Grype scan
grype myimage:latest --fail-on high

# Docker Scout
docker scout cves myimage:latest

Runtime Security

# Kubernetes securityContext
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  seccompProfile:
    type: RuntimeDefault

Docker Run Hardening

docker run \
  --read-only \
  --tmpfs /tmp \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --user 1000:1000 \
  --memory=512m \
  --cpus=0.5 \
  myimage

Image Signing

# Cosign
cosign sign --key cosign.key myimage:latest
cosign verify --key cosign.pub myimage:latest

# Docker Content Trust
export DOCKER_CONTENT_TRUST=1
docker push myimage:latest

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

Checklist

• [ ] Use minimal base images
• [ ] Run as non-root
• [ ] Drop all capabilities
• [ ] Read-only filesystem
• [ ] No privilege escalation
• [ ] Scan for vulnerabilities
• [ ] Sign images
• [ ] Implement network policies
• [ ] Use secrets management
• [ ] Enable audit logging