Container Security

A container's default security posture is better than a bare process and considerably worse than most people assume. It runs as root — the host's root, with a reduced but still substantial capability set — with a permissive seccomp filter and a writable filesystem.

None of that is required by anything you are likely to run. This lesson is turning it off.

Do not run as root

FROM node:22-alpine
WORKDIR /app
COPY --chown=node:node . .
USER node
CMD ["node", "server.js"]

Most official images ship a suitable non-root user already — node, postgres, nginx. Where one does not, make it, and use a high fixed UID so it cannot collide with a host account that means something:

RUN adduser -D -u 10001 app
USER 10001

Prefer the numeric form in USER. Kubernetes' runAsNonRoot check reads the image config and cannot tell whether a name resolves to UID 0, so a named user is rejected by some policies even when it is fine.

Drop capabilities

Root inside a container has around fourteen of Linux's forty-odd capabilities. A web application needs none of them.

docker run --cap-drop ALL --cap-add NET_BIND_SERVICE myapp

services:
  api:
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]

Drop everything, then add back only what actually fails. In practice most services need nothing at all — NET_BIND_SERVICE only matters for binding below port 1024, and the better answer there is to listen on 8080 and publish it as 80.

Two that deserve naming because they are the ones granted casually and they are the ones that end badly. SYS_ADMIN is close to root on the host — mounting filesystems, manipulating namespaces — and is the usual "just add this to make it work" for anything that mounts. SYS_PTRACE lets a process inspect and manipulate others in its namespace; useful for a debugger, not for a service.

--privileged is not a debugging step

docker run --privileged myapp        # don't

--privileged drops all of it: every capability granted, seccomp and AppArmor disabled, all host devices exposed. A privileged container can load kernel modules, read raw disks, and reach the host trivially. It is the single largest security decision available in one flag, and it is most often typed by someone narrowing down a permission error.

The right move when something needs a privilege is to find the specific one:

docker run --cap-add SYS_TIME myapp          # not --privileged
docker run --device /dev/ttyUSB0 myapp       # not --privileged

Seccomp, AppArmor, and no-new-privileges

Docker applies a default seccomp profile blocking around forty syscalls that no normal workload uses — kexec_load, mount, ptrace, and the rest of the kernel's attack surface. It is on unless you disable it, which --privileged does silently.

A custom profile, when you know what your workload calls:

docker run --security-opt seccomp=./profile.json myapp

And the flag worth adding to essentially everything:

docker run --security-opt no-new-privileges myapp

That sets the kernel's no_new_privs bit: the process and its children can never gain privileges through a setuid binary. It costs nothing and closes the most common privilege-escalation path inside a container.

Read-only root filesystem

docker run --read-only --tmpfs /tmp --tmpfs /run myapp

services:
  api:
    read_only: true
    tmpfs: [/tmp, /run]

Most services never write outside /tmp. Making the root filesystem read-only means an attacker who achieves code execution cannot drop a binary, modify configuration, or persist. The tmpfs mounts give back the few directories that genuinely need writing, in RAM, discarded on exit.

Turning this on usually surfaces one or two surprises — a framework writing a cache, a library writing a lockfile — and each one is worth knowing about anyway.

A hardened service

services:
  api:
    image: ghcr.io/acme/api@sha256:9f2a1c...
    user: "10001:10001"
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    pids_limit: 200
    mem_limit: 512m
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/healthcheck"]
      interval: 30s
      start_period: 20s

Every line is a decision this course has argued for. Note the image is pinned by digest, not tag — a later lesson makes that case.

dockerd-rootless-setuptool.sh install
export DOCKER_HOST=unix:///run/user/1000/docker.sock

{ "userns-remap": "default" }

Next up: resource limits — capping what a container can consume before it takes the host with it.