Run containers with a defensive baseline that survives production. Covers non-root users, read-only filesystems, dropped Linux capabilities, secret mounts instead of build-time bake-in, image scanning with trivy, distroless and minimal base images, and the Docker-bypasses-UFW firewall pitfall. Invoke when adding Docker to a VPS with UFW, writing a new Dockerfile, or pushing an image to a public re
Receba novas skills de DevOps e Infra toda segunda
1 email curto, só com as skills novas de DevOps e Infra. 4 minutos de leitura, sem spam, cancela com 1 clique.
Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.
Ler descrição completaRecolher descrição
Docker / Container Security
A pragmatic baseline for Docker on a single VPS or a small cluster. Covers the Dockerfile, the run-time configuration, and the host-side gotchas — particularly the UFW-bypass that catches most people once.
When to invoke
Installing Docker on a VPS that has UFW (read the UFW section first — Docker bypasses UFW by default)
Writing a new Dockerfile or docker-compose.yml for production
Pushing an image to a public registry
Periodic audit of running conta
[Description truncada. Veja o README completo no GitHub.]
