Improve docker container security

Jump to bottom

mviereck edited this page Oct 15, 2018 · 5 revisions

How to improve container security

Avoid root in container. Create an unprivileged user in container, e.g. with --user 1000:1000 or with a custom /etc/passwd file.
Drop all capabilities with --cap-drop ALL.
- Add only those capabilities your application needs indeed (if any) with e.g. --cap-add CHOWN.
- Avoid capabilitiy SYS_ADMIN that would allow root-like powers.
- Compare man capabilities and docker documentation about capabilities.
Forbid gaining privileges in container (e.g. with su) with option --security-opt no-new-privileges.
Mount container root file system read-only and only allow rw access for /tmp with --read-only --tmpfs /tmp.
Do NOT use --privileged. If you want to give access to specific devices, use e.g. --device /dev/snd.