Section 1
Image Security & Scanning
Build secure container images and scan for vulnerabilities
- Use minimal base images (distroless, Alpine, or scratch)
- Scan images for CVEs in CI/CD before pushing to registry
- Implement image signing and verification (cosign, Notary)
- Block images with critical/high vulnerabilities from deployment
- Keep base images updated with security patches
- Remove unnecessary packages and tools from production images
- Use multi-stage builds to minimize final image size
Section 2
Dockerfile Best Practices
Write secure Dockerfiles with hardened configurations
- Never run containers as root - use USER directive
- Avoid using latest tag - pin specific image versions
- Add HEALTHCHECK instruction for container health monitoring
- Use COPY instead of ADD unless extracting archives
- Set read-only root filesystem where possible
- Remove shell access in production images when not needed
- Use .dockerignore to exclude sensitive files from build context
Section 3
Runtime Protection
Protect running containers with security policies
- Drop all capabilities and add only those needed (--cap-drop ALL)
- Enable seccomp profiles to restrict syscalls
- Use AppArmor or SELinux for mandatory access control
- Implement read-only root filesystem (--read-only flag)
- Prevent privilege escalation (--security-opt=no-new-privileges)
- Limit container resources (CPU, memory, PIDs)
- Monitor container behavior for anomalies with eBPF
Section 4
Secrets Management
Securely handle sensitive data in containers
- Never bake secrets into container images
- Use secret management tools (Vault, AWS Secrets Manager)
- Mount secrets as files, not environment variables
- Rotate secrets regularly and automate rotation
- Use encrypted secrets at rest (Docker secrets, K8s secrets)
- Scan images for accidentally committed secrets
- Implement secrets injection at runtime, not build time
Section 5
Registry Security
Secure your container registry and supply chain
- Use private registries for proprietary images
- Enable vulnerability scanning in registry (Harbor, ECR, GCR)
- Implement role-based access control for push/pull operations
- Sign images and verify signatures before deployment
- Generate and maintain SBOM for all images
- Enable image immutability to prevent tag overwriting
- Implement image promotion pipelines (dev → staging → prod)
Section 6
Compliance & Auditing
Meet regulatory requirements for container workloads
- Implement CIS Docker Benchmark checks
- Enable container runtime logging and auditing
- Map container controls to SOC 2, PCI-DSS, HIPAA
- Maintain audit trail of image deployments
- Implement policy-as-code for container security
- Regular compliance assessments of container infrastructure
- Document remediation procedures for common vulnerabilities